def rule(event):
    if "ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter {" in event.deep_get(
        "Payload", default=""
    ):
        return True
    return False
