title: Driver to User-Mode Communication
body: <p>I am trying to write a tool to monitor processes. Whenever a high privileged process with SYSTEM privileges is created it will alert the user.
  I'm doing this with a driver that monitors every process creation and a user mode app to check if it runs under SYSTEM and if so to make the alert.
  For doing this the user-mode app should listen to the driver. I'm trying to do it with event. Whenever a process is created the driver will signal the event with IoCreateNotificationEvent (which the use-mode app listens to with WaitForSingleObject) and then the app will send an IRP to the driver to get the pid.
  That doesn't work well for me and I was looking for other methods to do that communication from the driver to a listening user-mode app and I couldn't find so..
  How can I make it work?</p>
  
  <p>Thanks for helping</p>