CmdID

CmdID / PowerShell / Cmdlets / Add

Add-Content

Adds content to the specified items, such as adding words to a file. PowerShell reference

From the PowerShell reference 15 parameters Alias ac 2 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Adds content to the specified items, such as adding words to a file. The Add-Content cmdlet appends content to a specified item or file. Content can be passed in from the pipeline or specified by using the Value parameter. If you need to create files or directories for the following examples, see New-Item.

Add-Content [-Path] <string[]> [-Value] <Object[]> [-PassThru] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-NoNewline] [-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <string>] [<CommonParameters>]
Add-Content [-Value] <Object[]> -LiteralPath <string[]> [-PassThru] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-NoNewline] [-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <string>] [<CommonParameters>]

Add a string to all text files with an exception

Add-Content -Path .\*.txt -Exclude help* -Value 'End of file'Identify

Add a date to the end of the specified files

Add-Content -Path .\DateTimeFile1.log, .\DateTimeFile2.log -Value (Get-Date) -PassThru Get-Content -Path .\DateTimeFile1.logIdentify

Add the contents of a specified file to another file

$From = Get-Content -Path .\CopyFromFile.txt Add-Content -Path .\CopyToFile.txt -Value $From Get-Content -Path .\CopyToFile.txtIdentify

Add the contents of a specified file to another file using the pipeline

Get-Content -Path .\CopyFromFile.txt | Add-Content -Path .\CopyToFile.txt Get-Content -Path .\CopyToFile.txtIdentify

Create a new file and copy content

Add-Content -Path .\NewFile.txt -Value (Get-Content -Path .\CopyFromFile.txt) Get-Content -Path .\NewFile.txtIdentify

Add content to a read-only file

New-Item -Path .\IsReadOnlyTextFile.txt -ItemType File Set-ItemProperty -Path .\IsReadOnlyTextFile.txt -Name IsReadOnly -Value $true Get-ChildItem -Path .\IsReadOnlyTextFile.txt Add-Content -Path .\IsReadOnlyTextFile.txt -Value 'Add value to read-only text file' -Force Get-Content -Path .\IsReadOnlyTextFile.txtIdentify

Its page in the reference: Add-Content.

Parameters

15 in the PowerShell reference
-CredentialNOTE: This parameter isn't supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.
-EncodingSpecifies the type of encoding for the target file. The default value is Default. The acceptable values for this parameter are as follows: - Ascii Uses ASCII (7-bit) character set. - BigEndianUnicode Uses UTF-16 with the big-endian byte order. - BigEndianUTF32 Uses UTF-32 with the big-endian byte order. - Byte Encodes a set of characters into a sequence of bytes. - Default Uses the encoding that corresponds to the system's active code page (usually ANSI). - Oem Uses the encoding that corresponds to the system's current OEM code page. - String Same as Unicode. - Unicode Uses UTF-16 with the little-endian byte order. - Unknown Same as Unicode. - UTF7 Uses UTF-7. - UTF8 Uses UTF-8. - UTF32 Uses UTF-32 with the little-endian byte order. Encoding is a dynamic parameter that the FileSystem provider adds to the Add-Content cmdlet. This parameter works only in file system drives.
-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they're retrieved.
-ForceOverrides the read-only attribute, allowing you to add content to a read-only file. For example, Force overrides the read-only attribute but it doesn't change file permissions.
-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. For more information, see about_Quoting_Rules.
-NoNewlineIndicates that this cmdlet doesn't add a new line or carriage return to the content. The string representations of the input objects are concatenated to form the output. No spaces or newlines are inserted between the output strings. No newline is added after the last output string.
-PassThruReturns an object representing the added content. By default, this cmdlet doesn't generate any output.
-PathSpecifies the path to the items that receive the additional content. Wildcard characters are permitted. The paths must be paths to items, not to containers. For example, you must specify a path to one or more files, not a path to a directory. If you specify multiple paths, use commas to separate the paths.
-StreamSpecifies an alternative data stream for content. If the stream doesn't exist, this cmdlet creates it. Wildcard characters aren't supported. Stream is a dynamic parameter that the FileSystem provider adds to Add-Content. This parameter works only in file system drives. You can use the Add-Content cmdlet to change the content of any alternate data stream, such as Zone.Identifier. However, we don't recommend this as a way to eliminate security checks that block files that are downloaded from the Internet. If you verify that a downloaded file is safe, use the Unblock-File cmdlet. This parameter was introduced in PowerShell 3.0.
-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.
-ValueSpecifies the content to be added. Type a quoted string, such as This data is for internal use only, or specify an object that contains content, such as the DateTime object that Get-Date generates. You can't specify the contents of a file by typing its path, because the path is just a string. You can use a Get-Content command to get the content and pass it to the Value parameter.
-ConfirmPrompts you for confirmation before running the cmdlet.
-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.

What looks for it

Sigma process creation rules that name Add-Content
mediumComputer Discovery And Export Via Get-ADComputer CmdletNasreddine Bencherchali (Nextron Systems)
mediumUser Discovery And Export Via Get-ADUser CmdletNasreddine Bencherchali (Nextron Systems)

See also

Clear-Content · Get-Content · Get-Item · New-Item · Set-Content