I'd use stream, actually, which can read them off the wire on the DNS. It's better and gets all the bad actors making broken requests that Windows throws away.
But to your question specifically - MonitorNoHandle seems perfect for this. Have you tried it? Does it do what you want? There's a list of reasons to use and to not use this in the docs for it. See especially the bottom - and how it won't read existing file contents and stuff.
