extend terminate-process.yml to include exit_group #970

mandiant · Feb 4, 2025 · b297d11 · b297d11
1 parent 0ea3394
commit b297d11
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/host-interaction/process/terminate/terminate-process.yml b/host-interaction/process/terminate/terminate-process.yml
@@ -23,6 +23,7 @@ rule:
       - api: System.Windows.Forms.Application::Exit
       - api: exit
       - api: Exit
+      - api: exit_group
       - and:
         - optional:
           - match: open process