A demo windows kernel driver written in Rust that monitors process creation events and streams them to a C++ user-mode application. This project's kernel logic is inspired by the ProcNotify example from windows internal guru Pavel Yosifovich.
Windows requires kernel drivers to be signed. You must create a self-signed certificate, sign the .sys file, and install that certificate into the trusted root certification authorities store on the target machine. You also need testsigning enabled on the windows machine.