In your question you speak about "hooking" on opening files, but afterwards you speak about detecting windows. These are different things..
Well, you might not be able to detect all events, if they are transient, but might be one approach periodically walking trough open file handles, see for example:
Listing Used Files[
^]