From dddf45baa97b224df926b964807ee51fde517692 Mon Sep 17 00:00:00 2001
From: Michael Hunhoff <michael.hunhoff@mandiant.com>
Date: Wed, 23 Mar 2022 11:34:36 -0600
Subject: [PATCH] adding get-process-image-filename

---
 nursery/get-process-image-filename.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 nursery/get-process-image-filename.yml

diff --git a/nursery/get-process-image-filename.yml b/nursery/get-process-image-filename.yml
new file mode 100644
index 00000000..ef18ee47
--- /dev/null
+++ b/nursery/get-process-image-filename.yml
@@ -0,0 +1,13 @@
+# generated using capa explorer for IDA Pro
+rule:
+  meta:
+    name: get process image filename
+    namespace: host-interaction/process
+    author: michael.hunhoff@mandiant.com
+    scope: basic block
+  features:
+    - and:
+      - os: windows
+      - or:
+        - api: kernel32.K32GetProcessImageFileName
+        - api: kernel32.GetProcessImageFileName