title: Is there a way other than "hooking" which can be used to monitor Native/SSDT API calls on a Windows system?
body: <p>I was told by someone with a lot of experience that there is at least one alternate way to monitor Windows OS calls, in the context of for example, creating Process Monitor-like functionality or developing an anti-virus scanner, which is not "hooking" and that this alternate method is more efficient than hooking. However, I am unsure of which alternatives to hooking there are in the context of developing a filter driver to perform this task.</p>