How can I tell in C# or VB.NET if a low-level hook is blocked by a high-integrity process?

Question

How can I tell in C# or VB.NET if a low-level hook is blocked by a high-integrity process?

jacky Perpète 126

Hello,

In a VB.NET application, I'm using a low-level hook to manage mouse movements on the screen.

Windows' built-in security measures prevent the low-level mouse hook from interacting with, for example, the Task Manager.

My program no longer receives mouse coordinates when the Windows Task Manager has focus.

To work around this situation, I don't want to run my application with elevated privileges as an administrator or use a signing certificate.

Is it possible to detect when my application's mouse hook is blocked by a high-integrity process? (API?)

RLWA32 48,416 Reputation points

2025-05-04T11:29:31.23+00:00

Proof of concept demo written in C++. The monitoring process is not running with elevated privileges and is not a UIAccess application.

1 answer

Your answer

RLWA32 48,416 Reputation points

2025-05-04T11:29:31.23+00:00

Proof of concept demo written in C++. The monitoring process is not running with elevated privileges and is not a UIAccess application.

Answer 1

RLWA32 48,416

You could use WinEvents to track changes to the foreground window. The event callback could determine if the process owning the foreground window has an integrity level greater than medium. If it does, the assumption would be that your low level mouse hook will not be called until the foreground window changes to a lower integrity level process.

Share via

How can I tell in C# or VB.NET if a low-level hook is blocked by a high-integrity process?

1 answer

Your answer