Если запустился процесс, сообщить об этом

public ManagementEventWatcher watcher;
 
private void Form1_Load(object sender, EventArgs e)
{
    watcher = new ManagementEventWatcher("Select * From Win32_ProcessTrace");
    watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
}
 
void watcher_EventArrived(object sender, EventArrivedEventArgs e)
{
    //здесь смотрите e.NewEvent
    //например: e.NewEvent["ProcessName"].ToString() - имя процесса
}
 
private void button1_Click(object sender, EventArgs e)
{
    watcher.Start(); //включаем наблюдение
}
 
private void button2_Click(object sender, EventArgs e)
{
    watcher.Stop(); //выключаем
}

using System.Management;
...
ManagementEventWatcher startWatch, stopWatch;
 
void StartMonitoring()
{
    startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
    startWatch.EventArrived += startWatch_EventArrived;
    startWatch.Start();
 
    stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
    stopWatch.EventArrived += stopWatch_EventArrived;
    stopWatch.Start();
}
 
void StopMonitoring()
{
    if (startWatch != null)
    {
        startWatch.Stop();
        startWatch.EventArrived -= startWatch_EventArrived;
        startWatch = null;
    }
    if (stopWatch != null)
    {
        stopWatch.Stop();
        stopWatch.EventArrived -= stopWatch_EventArrived;
        stopWatch = null;
    }
}
 
static void startWatch_EventArrived(object sender, EventArrivedEventArgs e)
{
    Console.WriteLine("Process started: {0}", e.NewEvent.Properties["ProcessName"].Value);
}
 
static void stopWatch_EventArrived(object sender, EventArrivedEventArgs e)
{
    Console.WriteLine("Process stopped: {0}", e.NewEvent.Properties["ProcessName"].Value);
}