Every NT version, in fact. Driver filters including filesystem filters are core NT feature. So you'd have to write a driver that hooked itself at appropriate s

Every NT version, in fact. Driver filters including filesystem filters are core NT feature. So you'd have to write a driver that hooked itself at appropriate step in IO Request processing, then it could inspect and gather data just like eBPF. Procmon uses diagnostic interfaces from outside kernel, might require debug permissions.