From bd37a30c9467630ddd05f90d4fdc9d4b51b4f707 Mon Sep 17 00:00:00 2001
From: re-fox <57954766+re-fox@users.noreply.github.com>
Date: Wed, 22 Jul 2020 16:32:35 -0400
Subject: [PATCH 1/2] Create check-mutex-and-exit.yml

---
 nursery/check-mutex-and-exit.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 nursery/check-mutex-and-exit.yml

diff --git a/nursery/check-mutex-and-exit.yml b/nursery/check-mutex-and-exit.yml
new file mode 100644
index 00000000..40b7c9c4
--- /dev/null
+++ b/nursery/check-mutex-and-exit.yml
@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: check mutex and exit
+    namespace: host-interaction/mutex
+    author: "@_re_fox"
+    scope: function
+    examples:
+      - 1d8fd13c890060464019c0f07b928b1a:0x00402eb0
+  features:
+    - and:
+        - or:
+          - api: CreateMutex
+          - api: CreateMutexEx
+        - api: GetLastError
+        - api: ExitProcess
+        - or:
+            - number: 2 = ERROR_FILE_NOT_FOUND
+            - number: 0xb7 = ERROR_ALREADY_EXISTS
+            - number: 5 = ERROR_ACCESS_DENIED

From be1088f709eac489163a47c2916fc09caad18d0d Mon Sep 17 00:00:00 2001
From: re-fox <57954766+re-fox@users.noreply.github.com>
Date: Wed, 22 Jul 2020 17:37:21 -0400
Subject: [PATCH 2/2] Update check-mutex-and-exit.yml

---
 nursery/check-mutex-and-exit.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/nursery/check-mutex-and-exit.yml b/nursery/check-mutex-and-exit.yml
index 40b7c9c4..f7c668ea 100644
--- a/nursery/check-mutex-and-exit.yml
+++ b/nursery/check-mutex-and-exit.yml
@@ -8,9 +8,7 @@ rule:
       - 1d8fd13c890060464019c0f07b928b1a:0x00402eb0
   features:
     - and:
-        - or:
-          - api: CreateMutex
-          - api: CreateMutexEx
+        - match: create mutex
         - api: GetLastError
         - api: ExitProcess
         - or: