WFP - Filtering child processes

NTDEV
4

You can call FwpmFilterAdd from a driver and add a new filter but I am not sure that you will be able to add a filter for a particular process/application from a driver. Looks like you will have to add a filter for all established connections and filter by process ID in your filter. You can also communicate with your application to add application filters.

Also, read this https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/533cd944-cb1a-4a1f-81ef-2ce53dadbe3f/should-fwpmconditionaleappid-condition-cause-a-callout-if-the-application-is-already-running?forum=wfp