diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py
index 906b2ba1e..18fea9f0c 100644
--- a/volatility/framework/plugins/windows/svcscan.py
+++ b/volatility/framework/plugins/windows/svcscan.py
@@ -35,7 +35,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
     is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check = lambda x: (10, 0) <= x < (10, 0, 16299),
                                                         fallback_checks = [("ObHeaderCookie", None, True),
                                                                            ("_HANDLE_TABLE", "HandleCount", False),
-                                                                           ("ObHeaderCookie", None, True)])
+                                                                           ("ObHeaderCookie", None, True),
+                                                                           ("_EPROCESS", "ControlFlowGuardEnabled", True)])
 
     is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299),
                                                            fallback_checks = [("ObHeaderCookie", None, True),