powershell - 如何使用 Powershell 事件检测 Windows 中哪些进程修改了文件？

Question

我知道您可以通过在 Powershell 中订阅来自 Windows 的事件来监控文件或目录；但是我怎么知道是哪个进程/pid做出了改变？

Register-ObjectEvent -InputObject $FileSystemWatcher  -EventName Created  -Action {

   $Object  = "{0} was  {1} at {2}" -f $Event.SourceEventArgs.FullPath,

   $Event.SourceEventArgs.ChangeType,

   $Event.TimeGenerated

   $WriteHostParams  = @{

   ForegroundColor = 'Green'

   BackgroundColor =  'Black'

   Object =  $Object

   }

   Write-Host $Event | Get-Member -Type Properties,Method,MemberSet,Event

}

标签： powershellfilesystemsntfs