Copy-Item

Copies an item from one location to another. PowerShell reference

From the PowerShell reference 16 parameters Aliases copy, cp, cpi 5 Sigma rules look for it

What it does

from the PowerShell reference, CC BY 4.0

Copies an item from one location to another. The Copy-Item cmdlet copies an item from one location to another location in the same namespace. For instance, it can copy a file to a folder, but it can't copy a file to a certificate drive. This cmdlet doesn't cut or delete the items being copied. The particular items that the cmdlet can copy depend on the PowerShell provider that exposes the item. For instance, it can copy files and directories in a file system drive and registry keys and entries in the registry drive. This cmdlet can copy and rename items in the same command. To rename an item, enter the new name in the value of the Destination parameter. To rename an item and not copy it, use the Rename-Item cmdlet.

Copy-Item [-Path] <String[]> [[-Destination] <String>] [-Container] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-PassThru] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-FromSession <PSSession>] [-ToSession <PSSession>] [<CommonParameters>]

Copy-Item -LiteralPath <String[]> [[-Destination] <String>] [-Container] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-PassThru] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-FromSession <PSSession>] [-ToSession <PSSession>] [<CommonParameters>]

Copy-Item [-Path] <String[]> [[-Destination] <String>] [-Container] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-PassThru] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]

Copy-Item -LiteralPath <String[]> [[-Destination] <String>] [-Container] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-PassThru] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]

Copy a file to the specified directory

Copy-Item "C:\Wabash\Logfiles\mar1604.log.txt" -Destination "C:\Presentation"Identify

Copy directory contents to an existing directory

Copy-Item -Path "C:\Logfiles\*" -Destination "C:\Drawings" -RecurseIdentify

Copy directory and contents to a new directory

Copy-Item -Path "C:\Logfiles" -Destination "C:\Drawings\Logs" -RecurseIdentify

Copy a file to the specified directory and rename the file

$copyParams = @{
Path = "\\Server01\Share\Get-Widget.ps1"
Destination = "\\Server12\ScriptArchive\Get-Widget.ps1.txt"
}
Copy-Item @copyParams

Identify

Copy a file to a remote computer

$Session = New-PSSession -ComputerName "Server01" -Credential "Contoso\User01"
Copy-Item "D:\Folder001\test.log" -Destination "C:\Folder001_Copy\" -ToSession $Session

Identify

Copy a folder to a remote computer

$Session = New-PSSession -ComputerName "Server02" -Credential "Contoso\User01"
Copy-Item "D:\Folder002\" -Destination "C:\Folder002_Copy\" -ToSession $Session

Identify

Recursively copy the entire contents of a folder to a remote computer

$Session = New-PSSession -ComputerName "Server04" -Credential "Contoso\User01"
Copy-Item "D:\Folder003\" -Destination "C:\Folder003_Copy\" -ToSession $Session -Recurse

Identify

Copy a file to a remote computer and then rename the file

$Session = New-PSSession -ComputerName "Server04" -Credential "Contoso\User01"
$copyParams = @{
Path = "D:\Folder004\scriptingexample.ps1"
Destination = "C:\Folder004_Copy\scriptingexample_copy.ps1"
ToSession = $Session
}
Copy-Item @copyParams

Identify

Copy a remote file to the local computer

$Session = New-PSSession -ComputerName "Server01" -Credential "Contoso\User01"
Copy-Item "C:\MyRemoteData\test.log" -Destination "D:\MyLocalData\" -FromSession $Session

Identify

Copy the entire contents of a remote folder to the local computer

$Session = New-PSSession -ComputerName "Server01" -Credential "Contoso\User01"
Copy-Item "C:\MyRemoteData\scripts" -Destination "D:\MyLocalData\" -FromSession $Session

Identify

Its page in the reference: Copy-Item.

Parameters

16 in the PowerShell reference

-ContainerIndicates that this cmdlet preserves container objects during the copy operation. By default, the Container parameter is set to True.

-CredentialNOTE: This parameter isn't supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.

-DestinationSpecifies the path to the new location. The default is the current directory. To rename the item being copied, specify a new name in the value of the Destination parameter.

-ExcludeSpecifies one or more path elements or patterns, such as "*.txt", to limit this cmdlet's operation. The value of this parameter filters against the wildcard-matching result of the Path parameter, not the final results. This parameter is only effective when the Path is specified with one or more wildcards. Since this parameter only filters on the paths resolved for the Path parameter, it doesn't filter any items discovered when recursing through child folders with the Recurse parameter.

-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they're retrieved.

-ForceIndicates that this cmdlet copies items that can't otherwise be changed, such as copying over a read-only file or alias.

-FromSessionThis is a dynamic parameter made available by the FileSystem provider. Specify the PSSession object from which a remote file is being copied. When you use this parameter, the Path and LiteralPath parameters refer to the local path on the remote machine. For more information, see about_FileSystem_Provider.

-IncludeSpecifies one or more path elements or patterns, such as "*.txt", to limit this cmdlet's operation. The value of this parameter filters against the wildcard-matching result of the Path parameter, not the final results. This parameter is only effective when the Path is specified with one or more wildcards. Since this parameter only filters on the paths resolved for the Path parameter, it doesn't filter any items discovered when recursing through child folders with the Recurse parameter.

-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. For more information, see about_Quoting_Rules.

-PassThruReturns an object that represents the item with which you're working. By default, this cmdlet doesn't generate any output.

-PathSpecifies, as a string array, the path to the items to copy. Wildcard characters are permitted.

-RecurseIndicates that this cmdlet does a recursive copy.

-ToSessionThis is a dynamic parameter made available by the FileSystem provider. Specify the PSSession object to which a remote file is being copied. When you use this parameter, the Destination parameter refers to the local path on the remote machine. For more information, see about_FileSystem_Provider.

-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.

-ConfirmPrompts you for confirmation before running the cmdlet.

-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.

What looks for it

Sigma process creation rules that name Copy-Item

highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems)

highPowerShell SAM CopyFlorian Roth (Nextron Systems)

mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali

mediumPotential Browser Data StealingNasreddine Bencherchali (Nextron Systems)

mediumSuspicious Copy From or To System DirectoryFlorian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)

Copy-Item

What it does

Parameters

What looks for it

See also