// ntddk.h

typedef enum _PSCREATETHREADNOTIFYTYPE {
  PsCreateThreadNotifyNonSystem,
  PsCreateThreadNotifySubsystems
} PSCREATETHREADNOTIFYTYPE;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ne-ntddk-_pscreatethreadnotifytype)

_PSCREATETHREADNOTIFYTYPE enumeration

Description

Indicates the type of thread notification. This enumeration is used in PsSetCreateThreadNotifyRoutineEx to register callback notifications associated with thread creation or deletion.

Constants

`PsCreateThreadNotifyNonSystem`

The driver-registered callback function is executed on the new non-system thread, which enables the callback function to perform tasks such as setting the initial thread context.

`PsCreateThreadNotifySubsystems`

Indicates that the driver-registered callback function is invoked for threads of all subsystems. Drivers can call NtQueryInformationThread to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.

PSCREATETHREADNOTIFYTYPE - NtDoc