I don't think so? I actually looked for such functionality recently and couldn't find anything. Kaspersky uses a hypervisor to hook syscalls[0] in order to prov

I don't think so? I actually looked for such functionality recently and couldn't find anything. Kaspersky uses a hypervisor to hook syscalls[0] in order to provide such functionality. There's also DTrace for Windows[1], but that requires being enabled through bcdedit which is a bit... meh. [0]: https://github.com/iPower/KasperskyHook https://github.com/iPower/KasperskyHook [1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace#installing-dtrace-under-windows https://docs.microsoft.com/en-us/windows-hardware/drivers/de...