get-process-heap-flags: use GetProcessHeap (#1184)

closes #1183 P
2026-10-12 02:18:39 +00:00 · 2026-08-14 14:55:43 -06:00
parent 781fe373db
commit 801a792c60
1 changed files with 3 additions and 1 deletions
@@ -15,7 +15,9 @@ rule:
      - al-khaser_x86.exe_:0x425470
  features:
    - and:
-      - match: PEB access
+      - or:
+        - match: PEB access
+        - api: GetProcessHeap
      - or:
        - and:
          - arch: i386