How can you check if a running process has blockdlls enabled, especially on different Windows versions?

On Windows 10, you can use the `GetProcessMitigationPolicy()` API with the `ProcessSignaturePolicy` structure to query whether `MicrosoftSignedOnly` is enabled. However, Windows 8 does not support this API for that policy; instead, you must use `NtQueryInformationProcess()` to retrieve the mitigation flags. The same approach is demonstrated in the [analysis article](/news/analysis-of-cobalt-strikes-blockdlls-exploitation) with open-source C code for both versions.