diff --git a/tests/netebpfext_unit/netebpfext_unit.cpp b/tests/netebpfext_unit/netebpfext_unit.cpp index 805ebb508d..19a8326971 100644 --- a/tests/netebpfext_unit/netebpfext_unit.cpp +++ b/tests/netebpfext_unit/netebpfext_unit.cpp @@ -955,6 +955,13 @@ TEST_CASE("process_invoke", "[netebpfext]") REQUIRE((HANDLE)client_context.process_context.creating_thread_id == create_info.CreatingThreadId.UniqueThread); REQUIRE(create_info.CreationStatus == STATUS_ACCESS_DENIED); REQUIRE(client_context.process_context.operation == PROCESS_OPERATION_CREATE); + + // Test process termination. + // Just verify that it doesn't crash. + usersime_invoke_process_creation_notify_routine(reinterpret_cast(&fake_eprocess), (HANDLE)1, nullptr); + + REQUIRE(client_context.process_context.process_id == 1); + REQUIRE(client_context.process_context.operation == PROCESS_OPERATION_DELETE); } #pragma endregion process \ No newline at end of file