EaseFilter Process Filter Driver SDK

Author : Micheal Alexander | Published On : 26 Aug 2026

The EaseFilter Process Filter Driver SDK is a commercial kernel-mode development kit designed for Windows process monitoring and protection. Operating within the Windows executive layer, it intercepts process and thread operations (creation, termination, and handle requests) before they reach their intended target.

This SDK allows developers to build robust security, auditing, and continuous monitoring applications—enabling system administrators to block malware, audit application usage, and sandbox untrusted executables.

Architecture

The EaseFilter ecosystem relies on a client-server architecture bridging kernel space and user space:

Kernel-Mode Component (EaseFlt.sys): The core filter driver that resides in the Windows kernel. It intercepts system calls related to process and thread creation/termination via Windows kernel callbacks (e.g., PsSetCreateProcessNotifyRoutineEx).

User-Mode Wrapper (FilterAPI.dll): A dynamic link library that handles communication between your user-mode application and the kernel driver.

Managed Control Layer (EaseFilter.FilterControl): A .NET wrapper available via NuGet, allowing C#, F#, and VB.NET applications to interface seamlessly with FilterAPI.dll.

Core Capabilities

Process and Thread Monitoring

The driver emits real-time callback notifications for critical system events:

Process Creation: Detects when a new process is initiated, capturing context such as the parent Process ID (PID), exact executable path, and command-line arguments.

Process Termination: Audits when and how a process exits.

Thread Tracking: Monitors the creation and termination of threads within existing processes.

Active Protection and Blocking

Unlike user-mode hooks which can be bypassed, the kernel-level interception allows your application to definitively allow or deny execution.

Execution Prevention: Untrusted binaries, such as downloaded malware or suspicious email attachments, can be blocked before the OS allocates memory for them.

Rule-Based Enforcement: The control flag DENY_NEW_PROCESS_CREATION can be applied to specific directories (e.g., preventing any executable from launching out of C:Temp*).

Process-Based File Access Control

When used in conjunction with the EaseFilter File System Filter Driver, you can implement strict sandboxing:

Grant read-only access to critical system folders (C:Windows) for specific processes (like notepad.exe).

Deny specific processes the ability to modify, rename, or copy sensitive files out of a protected directory.