Potential RemoteFXvGPUDisablement.EXE Abuse via PowerShell Module Hijacking

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the creation of a PowerShell module where the module contents specifically include "function Get-VMRemoteFXPhysicalVideoAdapter". This pattern is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. An attacker might use this technique to execute arbitrary code by tricking the legitimate signed binary into loading a malicious PowerShell module.