Windows PowerShell Module Creation with RemoteFXPhysicalVideoAdapter FunctionContents

Flags PowerShell module creation where ModuleContents includes Get-VMRemoteFXPhysicalVideoAdapter.

FreeUnreviewedSigmahighv1

windows-powershell-module-creation-with-remotefxphysicalvideoadapter-functioncon-38a7625e

title: Windows PowerShell Module Creation with RemoteFXPhysicalVideoAdapter FunctionContents
id: 7b3c101f-c694-44eb-b5e5-b361555030ee
related:
  - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5
    type: similar
  - id: f65e22f9-819e-4f96-9c7b-498364ae7a25
    type: similar
  - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5
    type: similar
  - id: 38a7625e-b2cb-485d-b83d-aff137d859f4
    type: derived
status: test
description: This rule identifies PowerShell module creation events where the module contents are set to include the function name Get-VMRemoteFXPhysicalVideoAdapter. Such module content configuration may indicate preparation to load or proxy functionality through a crafted PowerShell module. The detection relies on telemetry that records PowerShell module creation details, specifically the Payload content containing the expected ModuleContents string.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2021-07-13
modified: 2023-05-09
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    Payload|contains: ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter {
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell module creation events where the module contents are set to include the function name Get-VMRemoteFXPhysicalVideoAdapter. Such module content configuration may indicate preparation to load or proxy functionality through a crafted PowerShell module. The detection relies on telemetry that records PowerShell module creation details, specifically the Payload content containing the expected ModuleContents string.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.