Not sure, as I never used it. The filter engine runs in user space and several behaviors can be implemented as COM instances.

https://docs.microsoft.com/en-us/windows/win32/fwp/windows-f...