title: how to hook all new processes in Windows
body: <p>I want to write a program to detach dll injection or vulnerability exploit by creating a monitor thread for all processes.I want to do this in user level instead of inserting a driver.</p>
  
  <p>I try to use AppInit_DLLs to create a thread at DllMain,but it's not work if a program don't load user32.dll.</p>
  
  <p>I try to listen a new process creation event and suspend new process for loading my monitor dll,but it's not work well.</p>
  
  <p>Is there any methods to hook all new processes before they start run?</p>