Privacy and Security Check if Process is using Hardware-enforced Stack Protection in Windows 11

This tutorial will show you how to check if a process is using Hardware-enforced Stack Protection in Windows 10 an Windows 11.

Hardware-enforced Stack Protection offers robust protection against Return Oriented Programming (ROP) exploits since it maintains a record of the intended execution flow of a program.

The Kernel Mode Hardware Enforced Stack Protection security feature is applicable to Windows 11, version 22H2 and above, and provides additional security enhancement for kernel code.

You can use Task Manager to understand the state of enforcement of processes for Hardware-enforced Stack Protection.

Reference:

Here's How:

1 Open Task Manager (Ctrl+Shift+Esc).

2 Open the Details page in Task Manager. (see screenshot below)


3 Add the Hardware-enforced Stack Protection column to the "Processes" window in Task Manager if not already added. (see screenshot below)



4 Look in the Hardware-enforced Stack Protection column to see if each process you want is currently utilizing the Hardware-enforced Stack Protection security feature or not. (see screenshot below)

Disabled = Process is not protected by Hardware-enforced Stack Protection.

Compatible modules only = Compatibility mode. Compatibility mode provides a more flexible enforcement of stacks, at module granularity. When a return address mismatch occurs in this mode, it is checked to see if 1) it is not in an image binary (from dynamic code) or 2) in a module that is not compiled for /CETCOMPAT. If either hold true, the execution is allowed to continue.

All modules = Strict mode. Strictly enforces stack protections and will terminate the process if the intended return address is also not on the stack.

That's it,
Shawn Brink