diff --git a/host-interaction/process/get-process-heap-flags.yml b/host-interaction/process/get-process-heap-flags.yml
index f5ac9a96e..25cb1e9d8 100644
--- a/host-interaction/process/get-process-heap-flags.yml
+++ b/host-interaction/process/get-process-heap-flags.yml
@@ -15,7 +15,9 @@ rule:
       - al-khaser_x86.exe_:0x425470
   features:
     - and:
-      - match: PEB access
+      - or:
+        - match: PEB access
+        - api: GetProcessHeap
       - or:
         - and:
           - arch: i386