From 4874fd4b35f4a172fbd9b2feb455e93f0c75eba1 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:02:25 -0400 Subject: [PATCH] Update terminate-process.md Added new link and CAPE class for rule --- micro-behaviors/process/terminate-process.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/micro-behaviors/process/terminate-process.md b/micro-behaviors/process/terminate-process.md index b658727..5dc7ad0 100644 --- a/micro-behaviors/process/terminate-process.md +++ b/micro-behaviors/process/terminate-process.md @@ -52,9 +52,9 @@ Malware terminates a process. |[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill| |[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess| -|Tool: CAPE|Mapping|APIs| -|---|---|---| -|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess| +|Tool: CAPE|Class|Mapping|APIs| +|---|--|---|---| +|[terminates_remote_process](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/terminates_process.py)|TerminatesRemoteProcess|Terminate Process (C0018)|NtTerminateProcess| ### C0018 Snippet