Yes, it's usually a filter driver that delays execution until something like a hash is checked or other rules evaluate. Some products hash every interesting/executable file on the PC. They're powerful tools but can be extremely performance-sapping.