Создаем обработчик на IRP_MJ_CREATE -
The I/O Manager sends the IRP_MJ_CREATE request when a new file or directory is being created, or when an existing file, device, directory, or volume is being opened. Normally this IRP is sent on behalf of a user-mode application that has called a Microsoft Win32 function such as CreateFile or on behalf of a kernel-mode component that has called IoCreateFile, IoCreateFileSpecifyDeviceObjectHint, ZwCreateFile, or ZwOpenFile. If the create request is completed successfully, the application or kernel-mode component receives a handle to the file object.
Ну а в нем получаем указатель на файловый объект. Может там и не надо ZwQueryObject. Не помню, возможно в структуре FileObject есть прямой указатель на имя файла.