A small Windows kernel PoC checks for syscall hook detection around LSTAR, with C and assembly files visible in the GitHub scrape. The README is careful about its own limits, saying it is PatchGuard compatible but not VBS or Hyperguard compatible, so treat this as lab material before calling it a production control.