This is probably overengineered. The same could be done cross platform only using Processes.GetProcesses. I did it this way because initially i wanted to use Wmi events for process start and stop. This requires admin though, so i decided to not use it.