diff --git a/nursery/check-mutex-and-exit.yml b/nursery/check-mutex-and-exit.yml
new file mode 100644
index 00000000..f7c668ea
--- /dev/null
+++ b/nursery/check-mutex-and-exit.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: check mutex and exit
+    namespace: host-interaction/mutex
+    author: "@_re_fox"
+    scope: function
+    examples:
+      - 1d8fd13c890060464019c0f07b928b1a:0x00402eb0
+  features:
+    - and:
+        - match: create mutex
+        - api: GetLastError
+        - api: ExitProcess
+        - or:
+            - number: 2 = ERROR_FILE_NOT_FOUND
+            - number: 0xb7 = ERROR_ALREADY_EXISTS
+            - number: 5 = ERROR_ACCESS_DENIED