Anyone has probe to wait for a user mode confirmation in the RegistryCallback function?
There is any way to do something similar?
Where I could found the RegMon driver source code for NT? (is available?)
I need that implementation to detect when a suspicious process is acceding the registry and the user can select if the operation could be done.
thanks