CmdID / PowerShell / Cmdlets / Get
Get-ChildItem
Gets the items and child items in one or more specified locations. PowerShell reference
From the PowerShell reference
23 parameters
Aliases dir, gci, ls
3 Sigma rules look for it
What it does
Gets the items and child items in one or more specified locations. The Get-ChildItem cmdlet gets the items in one or more specified locations. If the item is a container, it gets the items inside the container, known as child items. You can use the Recurse parameter to get items in all child containers and use the Depth parameter to limit the number of levels to recurse. The Get-ChildItem cmdlet is designed to work with the items exposed by any provider. For example, items can be a file system file or directory, registry hive, or a certificate store. To list the providers available in your session, use the Get-PSProvider command. Some parameters are only available for a specific provider. For more information, see about_Providers.
Get-ChildItem [[-Path] <string[]>] [[-Filter] <string>] [-Include <string[]>] [-Exclude <string[]>] [-Recurse] [-Depth <uint32>] [-Force] [-Name] [-UseTransaction] [-Attributes <FlagsExpression[FileAttributes]>] [-Directory] [-File] [-Hidden] [-ReadOnly] [-System] [<CommonParameters>]Get-ChildItem [[-Filter] <string>] -LiteralPath <string[]> [-Include <string[]>] [-Exclude <string[]>] [-Recurse] [-Depth <uint>] [-Force] [-Name] [<CommonParameters>]Get child items from a file system directory
Get-ChildItem -Path C:\TestIdentifyGet child item names in a directory
Get-ChildItem -Path C:\Test -NameIdentifyGet child items in the current directory and subdirectories
Get-ChildItem -Path .\*.txt -Recurse -ForceIdentifyGet child items using the Include parameter
# When using the -Include parameter, if you don't include an asterisk in the path
# the command returns no output.
Get-ChildItem -Path C:\Test\ -Include *.txtIdentifyGet child items using the Exclude parameter
Get-ChildItem -Path C:\Test\LogsIdentifyGet the registry keys from a registry hive
Get-ChildItem -Path HKLM:\HARDWAREIdentifyGet all certificates with code-signing authority
Get-ChildItem -Path Cert:\* -Recurse -CodeSigningCertIdentifyGet items using the Depth parameter
Get-ChildItem -Path C:\Parent -Depth 2IdentifyGet the link target for a junction point
PS D:> New-Item -ItemType Junction -Name tmp -Target $Env:TEMP
PS D:> Get-ChildItem | Select-Object Name, *Target
Name Target
---- ------
tmp {C:\Users\user1\AppData\Local\Temp}IdentifyTrips 1 Sigma rule: mediumPotentially Suspicious Powershell Script Execution From Temp Folder by Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton
Get the link target for an AppX reparse point
Get-ChildItem ~\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe |
Select-Object Mode, LinkTarget, LinkType, NameIdentifyIts page in the reference: Get-ChildItem.
Parameters
Show its 23 parameters
-AttributesNOTE: This parameter is only available in the FileSystem provider.
Gets files and folders with the specified attributes. This parameter supports all attributes and lets you specify complex combinations of attributes.
For example, to get non-system files (not directories) that are encrypted or compressed, type:
Get-ChildItem -Attributes !Directory+!System+Encrypted, !Directory+!System+Compressed
To find files and folders with commonly used attributes, use the Attributes parameter. Or, the parameters Directory, File, Hidden, ReadOnly, and System.
The Attributes parameter supports the following values:
- Archive
- Compressed
- Device
- Directory
- Encrypted
- Hidden
- IntegrityStream
- Normal
- NoScrubData
- NotContentIndexed
- Offline
- ReadOnly
- ReparsePoint
- SparseFile
- System
- Temporary
For a description of these attributes, see the FileAttributes enumeration.
To combine attributes, use the following operators:
- ! (NOT)
- + (AND)
- , (OR)
Don't use spaces between an operator and its attribute. Spaces are accepted after commas.
For common attributes, use the following abbreviations:
- D (Directory)
- H (Hidden)
- R (Read-only)
- S (System)-CodeSigningCertNOTE: This parameter is only available in the Certificate provider.
To get a list of certificates that have Code Signing in their EnhancedKeyUsageList property value, use the CodeSigningCert parameter.-DepthThis parameter was added in PowerShell 5.0 and enables you to control the depth of recursion. By default, Get-ChildItem displays the contents of the parent directory. The Depth parameter determines the number of subdirectory levels that are included in the recursion and displays the contents.
For example, -Depth 2 includes the Path parameter's directory, first level of subdirectories, and second level of subdirectories. By default directory names and filenames are included in the output.
NOTE: The Depth parameter has no effect when used with the Include parameter. To work around this issue, use the Filter parameter instead. This is fixed in PowerShell 6 and higher.
NOTE: On a Windows computer from PowerShell or cmd.exe, you can display a graphical view of a directory structure with the tree.com command.-DirectoryNOTE: This parameter is only available in the FileSystem provider.
To get a list of directories, use the Directory parameter or the Attributes parameter with the Directory property. You can use the Recurse parameter with Directory.-DnsNameNOTE: This parameter is only available in the Certificate provider.
Specifies a domain name or name pattern to match with the DNSNameList property of certificates the cmdlet gets. The value of this parameter can either be Unicode or ASCII. Punycode values are converted to Unicode. Wildcard characters (*) are permitted.
This parameter was reintroduced in PowerShell 7.1-DocumentEncryptionCertNOTE: This parameter is only available in the Certificate provider.
To get a list of certificates that have Document Encryption in their EnhancedKeyUsageList property value, use the DocumentEncryptionCert parameter.-EkuNOTE: This parameter is only available in the Certificate provider.
Specifies text or a text pattern to match with the EnhancedKeyUsageList property of certificates the cmdlet gets. Wildcard characters (*) are permitted. The EnhancedKeyUsageList property contains the friendly name and the OID fields of the EKU.
This parameter was reintroduced in PowerShell 7.1-ExcludeSpecifies an array of one or more string patterns to be matched as the cmdlet gets child items. Any matching item is excluded from the output. Enter a path element or pattern, such as *.txt or A*. Wildcard characters are accepted.
A trailing asterisk (*) in the Path parameter is optional. For example, -Path C:\Test\Logs or -Path C:\Test\Logs\*. If a trailing asterisk (*) is included, the command recurses into the Path parameter's subdirectories. Without the asterisk (*), the contents of the Path parameter are displayed. More details are included in Example 5 and the Notes section.
The Include and Exclude parameters are applied by PowerShell after file enumeration. Both parameters can be used together. However, the exclusions are applied after the inclusions, which can affect the final output.
NOTE: The Include and Exclude parameters have no effect when used with the LiteralPath parameter. This is fixed in PowerShell 7.-ExpiringInDaysNOTE: This parameter is only available in the Certificate provider.
Specifies that the cmdlet should only return certificates that are expiring in or before the specified number of days. A value of zero (0) gets certificates that have expired.
This parameter was reintroduced in PowerShell 7.1-FileNOTE: This parameter is only available in the FileSystem provider.
To get a list of files, use the File parameter. You can use the Recurse parameter with File.-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports filters. Filters are more efficient than other parameters. The provider applies the filter when the cmdlet gets the objects rather than having PowerShell filter the objects after they're retrieved.
The filter string is passed to the .NET API to enumerate files. The parameter only accepts a single string. The value of the Filter parameter can include wildcard characters, however the API only supports * and ? wildcards.
The Include and Exclude parameters support the *, ?, and [] wildcard patterns and can accept an array of strings.-FollowSymlinkNOTE: This parameter is only available in the FileSystem provider.
By default, the Get-ChildItem cmdlet displays symbolic links to directories found during recursion, but doesn't recurse into them. Use the FollowSymlink parameter to search the directories that target those symbolic links. The FollowSymlink is a dynamic parameter and is supported only in the FileSystem provider.
This parameter was introduced in PowerShell 6.0.-ForceAllows the cmdlet to get items that otherwise can't be accessed by the user, such as hidden or system files. The Force parameter doesn't override security restrictions. Implementation varies by provider. For more information, see about_Providers.-HiddenNOTE: This parameter is only available in the FileSystem provider.
To get only hidden items, use the Hidden parameter or the Attributes parameter with the Hidden property. By default, Get-ChildItem doesn't display hidden items. Use the Force parameter to get hidden items.-IncludeSpecifies an array of one or more string patterns to be matched as the cmdlet gets child items. Any matching item is included in the output. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
The Include and Exclude are applied by PowerShell after file enumeration. Both parameters can be used together. However, the exclusions are applied after the inclusions, which can affect the final output.
NOTE: The Depth parameter has no effect when used with the Include parameter. To work around this issue, use the Filter parameter instead. This is fixed in PowerShell 6. The Include and Exclude parameters have no effect when used with the LiteralPath parameter. This is fixed in PowerShell 7.-LiteralPathSpecifies a path to one or more locations, or target paths, to be searched. The value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell to not interpret any characters as escape sequences.
For more information, see about_Quoting_Rules.
NOTE: The Include and Exclude parameters have no effect when used with the LiteralPath parameter. This is fixed in PowerShell 7.-NameGets only the names of the items in the location. The output is a string object that can be sent down the pipeline to other commands. The names returned are relative to the value of the Path parameter.-PathSpecifies a path to one or more locations, or target paths, to be searched. If not specified, the target path is the current directory (.). Wildcards are accepted. Use care when using the Path parameter with the Recurse parameter. For more information, see the NOTES section of this article.-ReadOnlyNOTE: This parameter is only available in the FileSystem provider.
To get only read-only items, use the ReadOnly parameter or the Attributes parameter ReadOnly property.-RecurseGets the items in the specified locations and in all child items of the locations.-SSLServerAuthenticationNOTE: This parameter is only available in the Certificate provider.
To get a list of certificates that have Server Authentication in their EnhancedKeyUsageList property value, use the SSLServerAuthentication parameter.-SystemNOTE: This parameter is only available in the FileSystem provider.
Gets only system files and directories. To get only system files and folders, use the System parameter or Attributes parameter System property.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.What looks for it
highPowerShell Execution With Potential Decryption CapabilitiesX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
mediumPrivate Keys Reconnaissance Via CommandLine Toolsfrack113, Nasreddine Bencherchali (Nextron Systems)