Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / ps_script. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|startswith: function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers. Logsource: windows / process_creation. Rule: title: Python One-Liners with Base64 Decoding id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b related: - id: 55e862a8-dd9c-4651-807a-f21fcad56716 type: similar status: experimental description: 'Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion. ' references: - https://docs.python.org/3/library/base64.html - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-09 tags: - attack.execution - attack.stealth - attack.t1059.006 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \python - OriginalFileName|contains: python selection_cli: CommandLine|contains|all: - import - base64 - ' -c' CommandLine|contains: - .decode - b16decode - b32decode - b32hexdecode - b64decode - b85decode - z85decode condition: all of selection_* falsepositives: - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml