Monitor mapped file modification

S4431

I want to monitor filesystem changes, so I created a minifilter.
How can I determine if a process is modifying a mapped file?

When a process performs the following actions:

CreateFile
CreateFileMapping
MapViewOfFileEx
Write data to file
UnmapViewOfFile
Close CreateFileMapping Handle
Close CreateFile Handle

I get the following IRP callbacks:

CreateFile
      IRP_MJ_CREATE
      IRP_MJ_QUERY_INFORMATION

CreateFileMapping
      IRP_MJ_QUERY_INFORMATION
      IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
      IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION

MapViewOfFileEx
      No IRP

Write data to file
      No IRP

UnmapViewOfFile
      No IRP

Close Handles
      IRP_MJ_CLEANUP
      IRP_MJ_CLOSE (this IRP comes from the system process)

After a few seconds I get the following IRP, probably from the cache manager.
      IRP_MJ_ACQUIRE_FOR_MOD_WRITE (this IRP comes from the system process)
      IRP_MJ_WRITE (this IRP comes from the system process)
      IRP_MJ_RELEASE_FOR_MOD_WRITE (this IRP comes from the system process)

When the application creates a section using CreateFileMapping, I get a IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION callback and can check the section permissions (read only or read write),
but I can't tell the difference between a scenario with modifying the file, and opening a mapped file with read-write permissions but without modifying the file.

I thought of several options to solve the problem, so far I haven't been able to move forward with any of them.

Idea 1:
On IRP_MJ_CLEANUP callback, I can check whether there is pending IO for writing on this file object.
But I haven't found how to do it.

Idea 2:
When the application unmapps the page, check if the page is marked "dirty", if so then the application has changed the contents of the file.
The problem is I haven't found how to get a kernel callback when the application calls UnmapViewOfFile.
I do not want to use user-mode hooks.

Idea 3:
When the cache manager sends IRP_MJ_WRITE, I can somehow correlate it with the process that actually made the change.
But I haven't found a reliable way to do it. Think of a situation where a process wrote to the file named file1 and then immediately changed the name of file1 to file2,
although the writing was to the file file1, the IRP_MJ_WRITE will be on file2.