 <p><a href="http://msdn.microsoft.com/en-us/library/windows/hardware/ff540402%28v=vs.85%29.aspx" rel="nofollow">File system minifilter drivers</a> is the way to do this. </p> <p>But the tricky part would be how do specify process to monitor. If you are thinking of PID then its quite straight forward, but if you are thinking of using process/executable name like <em>notepad.exe</em> then that becomes little complicated.</p> <p>Just to give you hint, you can get PID for the operation in mini filter but not process name. So you will have to maintain a map of PID to process name in your minifilter driver. You way want to use <a href="http://msdn.microsoft.com/en-us/library/windows/hardware/ff559953%28v=vs.85%29.aspx" rel="nofollow">PsSetCreateProcessNotifyRoutineEx</a> and <a href="http://msdn.microsoft.com/en-us/library/windows/hardware/ff559957%28v=vs.85%29.aspx" rel="nofollow">PsSetLoadImageNotifyRoutine</a>.</p>