CmdID

CmdID / PowerShell / Cmdlets / Add

Add-PSSnapin

Adds one or more Windows PowerShell snap-ins to the current session. PowerShell reference

From the PowerShell reference 2 parameters Alias asnp 2 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Adds one or more Windows PowerShell snap-ins to the current session. The Add-PSSnapin cmdlet adds registered Windows PowerShell snap-ins to the current session. After the snap-ins are added, you can use the cmdlets and providers that the snap-ins support in the current session. To add the snap-in to all future Windows PowerShell sessions, add an Add-PSSnapin command to your Windows PowerShell profile. For more information, see about_Profiles. Beginning in Windows PowerShell 3.0, the core commands that are included in Windows PowerShell are packaged in modules. The exception is Microsoft.PowerShell.Core, which is a snap-in (PSSnapin). By default, only the Microsoft.PowerShell.Core snap-in is added to the session. Modules are imported automatically on first use and you can use the Import-Module cmdlet to import them.

Add-PSSnapin [-Name] <String[]> [-PassThru] [<CommonParameters>]

Add snap-ins

PS C:> Add-PSSnapin -Name Microsoft.Exchange, Microsoft.Windows.ADIdentify

Add all the registered snap-ins

PS C:> Get-PSSnapin -Registered | Add-PSSnapin -PassThruIdentify

Register a snap-in and add it

PS C:> Get-PSSnapin PS C:> Get-PSSnapin -Registered PS C:> Set-Alias installutil $Env:windir\Microsoft.NET\Framework\v2.0.50727\installutil.exe PS C:> installutil C:\Dev\Management\ManagementCmdlets.dll PS C:> Get-PSSnapin -Registered PS C:> Add-PSSnapin ManagementFeatures PS C:> Get-Command -Module ManagementFeatures PS C:> (Get-Command Set-Alias).PSSnapinIdentify

Its page in the reference: Add-PSSnapin.

Parameters

2 in the PowerShell reference
-NameSpecifies the name of the snap-in. This is the Name, not the AssemblyName or ModuleName. Wildcards are permitted. To find the names of the registered snap-ins on your system, type Get-PSSnapin -Registered.
-PassThruIndicates that this cmdlet returns an object that represents each added snap-in. By default, this cmdlet does not generate any output.

What looks for it

Sigma process creation rules that name Add-PSSnapin
highEmail Exifiltration Via PowershellNasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea)
highExchange PowerShell Snap-Ins UsageFPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)