To protect a process from suspension and/or termination, implement the ProcessHandleOperation and handle it by removing the PROCESS_SUSPEND_RESUME and PROCESS_TERMINATE flags from the DesiredAccess event parameter. This will prevent the newly-created handle from being used to suspend or terminate the process.