def rule(event):
    if "ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter {" in event.deep_get(
        "Data", default=""
    ):
        return True
    return False
