Query: Sigma rule for Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T
Matching passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / ps_script. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|startswith: function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Setupapi.dll Activity id: 285b85b1-a555-4095-8652-a8a4106af63f status: test description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. references: - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20 author: Konstantin Grishchenko, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \runonce.exe ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - setupapi.dll - InstallHinfSection condition: selection falsepositives: - Scripts and administrative tools that use INF files for driver installation with setupapi.dll level: medium