I'm no WMI expert but I was told (and said in the post): A polling query is particularly tragic in the case of Win32_Process, since Win32_ProcessStartTrace doe

I'm no WMI expert but I was told (and said in the post): A polling query is particularly tragic in the case of Win32_Process, since Win32_ProcessStartTrace does the same thing without polling. So yeah, I think you can get process creation notifications without polling. Reference: https://twitter.com/kobyk/status/901561105570570242 https://twitter.com/kobyk/status/901561105570570242