Windows itself does not, 3rd party firewall/HIDS software (ZoneAlarm, Outpost, etc) for Windows has done this by intercepting APIs to do things like call execut

Windows itself does not, 3rd party firewall/HIDS software (ZoneAlarm, Outpost, etc) for Windows has done this by intercepting APIs to do things like call executables with internet access, OpenProcess calls, raw disk IO, registry writes to startup entries, etc.