We have a minifilter trying to record changed to files.
We see a file being opened for read access and later the pre operation callback for IRP_MJ_WRITE is called (the file has never been opened for writing according to procmon).
Why is this? How can we detect a “real write”?