Research reference — detection of unauthorized presentation-path hooks in Windows graphics workflows.
