add /integritycheck in Command Line
PsSetCreateProcessNotifyRoutine - notifies the driver about new/terminated processes
PsSetCreateProcessNotifyRoutineEx - notifies the driver about new processes being created, allows to kill them before they can run
PsSetCreateThreadNotifyRoutine - notifies the driver about new/terminated threads
PsSetLoadImageNotifyRoutine - notifies the driver about DLLs loaded by processes