Dear experts,
I /* hate to say this but */ have a sort of software package that includes WFP callout driver and (optionally) TDI filter driver.
The driver registers for \Callback\PowerState. On receive of PO_CB_SYSTEM_STATE_LOCK notifications it unregisters or registers the WFP (or TDI) stuff. This causes quite heavy activity, but tolerable with normal infrequent suspend/resume.
Now, users install this on laptops that support Modern standby. Which is actually S0 and should not require shutting down network interfaces and network activity (?)
How to tell in the PowerState callback transition to Modern standby from Sx? The documentation says that the EventSpecific parameter can be only TRUE or FALSE?
A bigger question is, is it worth to let the system go to Modern Standby when it runs kind of software that requires almost permanent network communication? (why it requires network communication - it is another question. I don't have control on this).
Should we advice the users to disable Modern Standby and use only classic sleep (when the lid closes or user clicks Sleep in the GUI)?
Update: reading on Activators... It looks like I need an activator.
... which is actually S0 and should not require shutting down network interfaces ...
The point of Modern Standby is that no transition or notification is supposed to be needed. When all the drivers report that they are in a safe state, the operating system can simply decide to turn off the power without telling anyone. If your hardware cannot allow itself to be powered off without notice, then your device needs to block Modern Standby.
We have a similar problem. The docs state:
Activators are system components and their runtime and behaviors cannot be changed by system hardware designers.
Activators seem to be a black box. How can you create an activator and/or interact with the provided activators?
Mr. Roberts, it's so good to see you still here. With all respect - the Modern Standby is a distinct state. Entry and exit are marked with distinct event log events. So it looks like there are notifications and some system entities use them to schedule their activity. Not even to mention the directed S4 thing (which I hope I don't need yet).
Obviously Microsoft does not want to break a lot of existing drivers, so they avoid new messages and parameter values.
From the documentation and powercfg /a output, it looks like M.S and normal Sx are mutually exclusive: if M.S. is active, normal Sx will not be called. If so, distinguishing them will be easy: if one is supported, it will occur and the other won't.
Am still experimenting with Modern Standby on Dell Latitude laptop. It enters M.S. (Kernel-power event 506) and exits after few seconds (event 507) for several reasons. For one: "Austerity Battery Drain budget Exceeded" 
Also there are interesting events 172: one says "Connectivity state in standby: Connected, Reason: None", then "Connectivity state in standby: Disconnected, Reason: Policy Setting".