Process Monitor ebpf program should report process SID and CWD #191
Description
Describe the feature you'd like supported
Current processor monitoring ebpf program reports process command-line and image path, in addition to thread an PID creating process.
Proposed solution
Some more information that can be added to the process_info_t is:
- New process's main thread's primary token's SID
- New process's current working directory
- New process' primary thread's ID.
Additional context
No response