How can you check if a running process has blockdlls enabled, especially on different Windows versions?
On Windows 10, you can use the `GetProcessMitigationPolicy()` API with the `ProcessSignaturePolicy` structure to query whether `MicrosoftSignedOnly` is enabled. However, Windows 8 does not support this API for that policy; instead, you must use `NtQueryInformationProcess()` to retrieve the mitigation flags. The same approach is demonstrated in the analysis article with open-source C code for both versions.
GetProcessMitigationPolicyNtQueryInformationProcessWindows 8Windows 10ProcessSignaturePolicyblockdlls