def rule(event):
    if event.deep_get("ScriptBlockText", default="").startswith(
        "function Get-VMRemoteFXPhysicalVideoAdapter {"
    ):
        return True
    return False
