Welcome to the Lounge

• There, I fixed it.

honey the codewitch wrote:

I'm looking back on it going "that's wicked code"
I love those moments when I impress myself. Unfortunately I'm not completely certain I could repeat this wizardry.

private bool SetupEventWatcher()
{
    if (Watcher != null)
        return false;

    int nTimespanInSeconds = 1;
    string strScope = @"\\.\root\CIMv2";
    string strWQL = $"SELECT * FROM __InstanceOperationEvent WITHIN {nTimespanInSeconds} WHERE TargetInstance ISA 'Win32_Process'";
    Watcher = new ManagementEventWatcher(strScope, strWQL);
    Watcher.EventArrived += new EventArrivedEventHandler(OnEventArrived);
    Watcher.Start();

    return true;
}

private void OnEventArrived(object sender, EventArrivedEventArgs e)
{
    // Ignore __InstanceModificationEvent, you'll get tons and they're useless
    TrackedEventType tet = TrackedEventType.Unknown;
    if (e.NewEvent.ClassPath.ClassName == "__InstanceCreationEvent")
        tet = TrackedEventType.Creation;
    if (e.NewEvent.ClassPath.ClassName == "__InstanceDeletionEvent")
        tet = TrackedEventType.Deletion;
    if (tet == TrackedEventType.Unknown)
        return;

    foreach (PropertyData pd in e.NewEvent.Properties)
    {
        // pd.Name = SECURITY_DESCRIPTOR, TargetInstance, TIME_CREATED
        if (pd.Name == "TargetInstance")
        {
            if (pd.Value is ManagementBaseObject mbo)
            {
                if ( mbo.Properties is PropertyDataCollection pdc )
                {
                    // ~45 properties
                    ListViewItem lvi = CreateEventLVI(tet, mbo.Properties);
                    if (lvi != null)
                        InsertEventLVI(lvi);
                }
            }
        }
    }
}

private ListViewItem CreateEventLVI(TrackedEventType tet, PropertyDataCollection pdc)
{
    foreach (PropertyData pd in pdc)
    {
        if (pd.Name == "Name")
            ...pd.Value is the name of the EXE
        if (pd.Name == "CommandLine")
            ...pd.Value contains the cmd line args
    } // foreach PropertyData