CmdID / PowerShell / Cmdlets / Get
Get-Content
Gets the content of the item at the specified location. PowerShell reference
From the PowerShell reference
16 parameters
Aliases cat, gc, type
4 Sigma rules look for it
What it does
Gets the content of the item at the specified location. The Get-Content cmdlet gets the content of the item at the location specified by the path, such as the text in a file or the content of a function. For files, the content is read one line at a time and returns a collection of objects, each representing a line of content. Beginning in PowerShell 3.0, Get-Content can also get a specified number of lines from the beginning or end of an item.
Get-Content [-ReadCount <Int64>] [-TotalCount <Int64>] [-Tail <Int32>] [-Path] <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Force] [-Credential <PSCredential>] [-UseTransaction] [-Delimiter <String>] [-Wait] [-Raw] [-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <String>] [<CommonParameters>]Get-Content [-ReadCount <Int64>] [-TotalCount <Int64>] [-Tail <Int32>] -LiteralPath <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Force] [-Credential <PSCredential>] [-UseTransaction] [-Delimiter <String>] [-Wait] [-Raw] [-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <String>] [<CommonParameters>]Get the content of a text file
1..100 | ForEach-Object {
Add-Content -Path .\LineNumbers.txt -Value "This is line $_."
}
Get-Content -Path .\LineNumbers.txtIdentifyLimit the number of lines Get-Content returns
Get-Content -Path .\LineNumbers.txt -TotalCount 5IdentifyGet a specific line of content from a text file
(Get-Content -Path .\LineNumbers.txt -TotalCount 25)[-1]IdentifyGet the last line of a text file
Get-Item -Path .\LineNumbers.txt | Get-Content -Tail 1IdentifyGet the content of an alternate data stream
Set-Content -Path .\Stream.txt -Value 'This is the content of the Stream.txt file'
# Specify a wildcard to the Stream parameter to display all streams of the recently
# created file.
Get-Item -Path .\Stream.txt -Stream *IdentifyGet raw content
$raw = Get-Content -Path .\LineNumbers.txt -Raw
$lines = Get-Content -Path .\LineNumbers.txt
Write-Host "Raw contains $($raw.Count) lines."
Write-Host "Lines contains $($lines.Count) lines."IdentifyUse Filters with Get-Content
Get-Content -Path C:\Temp\* -Filter *.logIdentifyGet file contents as a byte array
$byteArray = Get-Content -Path C:\temp\test.txt -Encoding Byte -Raw
Get-Member -InputObject $byteArrayIdentifyIts page in the reference: Get-Content.
Parameters
-CredentialNOTE: This parameter isn't supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.-DelimiterSpecifies the delimiter that Get-Content uses to divide the file into objects while it reads. The default is \n, the end-of-line character. When reading a text file, Get-Content returns a collection of string objects, each ending with an end-of-line character. When you enter a delimiter that doesn't exist in the file, Get-Content returns the entire file as a single, undelimited object.
You can use this parameter to split a large file into smaller files by specifying a file separator, as the delimiter. The delimiter is preserved (not discarded) and becomes the last item in each file section.
Delimiter is a dynamic parameter that the FileSystem provider adds to the Get-Content cmdlet. This parameter works only in file system drives.
NOTE: Currently, when the value of the Delimiter parameter is an empty string, Get-Content does not return anything. This is a known issue. To force Get-Content to return the entire file as a single, undelimited string. Enter a value that doesn't exist in the file.-EncodingSpecifies the type of encoding for the target file. The default value is Default.
The acceptable values for this parameter are as follows:
- Ascii Uses ASCII (7-bit) character set.
- BigEndianUnicode Uses UTF-16 with the big-endian byte order.
- BigEndianUTF32 Uses UTF-32 with the big-endian byte order.
- Byte Encodes a set of characters into a sequence of bytes.
- Default Uses the encoding that corresponds to the system's active code page (usually ANSI).
- Oem Uses the encoding that corresponds to the system's current OEM code page.
- String Same as Unicode.
- Unicode Uses UTF-16 with the little-endian byte order.
- Unknown Same as Unicode.
- UTF7 Uses UTF-7.
- UTF8 Uses UTF-8.
- UTF32 Uses UTF-32 with the little-endian byte order.
Encoding is a dynamic parameter that the FileSystem provider adds to the Get-Content cmdlet. This parameter works only in file system drives.
When reading from and writing to binary files, use a value of Byte for the Encoding dynamic parameter and a value of 0 for the ReadCount parameter. A ReadCount value of 0 reads the entire file in a single read operation and converts it into a single object (PSObject). …-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter.
Enter a path element or pattern, such as *.txt. Wildcard characters are permitted.
The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they're retrieved.-ForceForce can override a read-only attribute or create directories to complete a file path. The Force parameter doesn't attempt to change file permissions or override security restrictions.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
For more information, see about_Quoting_Rules.-PathSpecifies the path to an item where Get-Content gets the content. Wildcard characters are permitted. The paths must be paths to items, not to containers. For example, you must specify a path to one or more files, not a path to a directory.-RawIgnores newline characters and returns the entire contents of a file in one string with the newlines preserved. By default, newline characters in a file are used as delimiters to separate the input into an array of strings. This parameter was introduced in PowerShell 3.0.
Raw is a dynamic parameter that the FileSystem provider adds to the Get-Content cmdlet This parameter works only in file system drives.-ReadCountSpecifies how many lines of content are sent through the pipeline at a time. The default value is 1. A value of 0 (zero) or negative numbers sends all the content at one time.
This parameter doesn't change the content displayed, but it does affect the time it takes to display the content. As the value of ReadCount increases, the time it takes to return the first line increases, but the total time for the operation decreases. This can make a perceptible difference in large items.-StreamGets the contents of the specified alternate NTFS file stream from the file. Enter the stream name. Wildcards aren't supported.
Stream is a dynamic parameter that the FileSystem provider adds to the Get-Content cmdlet. This parameter works only in file system drives on Windows systems.
This parameter was introduced in Windows PowerShell 3.0.-TailSpecifies the number of lines from the end of a file or other item. You can use the Tail parameter name or its alias, Last. Negative values cause the cmdlet to return the entire contents.
This parameter was introduced in PowerShell 3.0.-TotalCountSpecifies the number of lines from the beginning of a file or other item. Negative values cause the cmdlet to return the entire contents.
You can use the TotalCount parameter name or its aliases, First or Head.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.-WaitCauses the cmdlet to wait indefinitely, keeping the file open, until interrupted. While waiting,
Get-Content checks the file once per second and outputs new lines if present. When used with the
TotalCount parameter, Get-Content waits until the specified number of lines are available in
the specified file. For example, if you specify a TotalCount of 10 and the file already has 10
or more lines, Get-Content returns the 10 lines and exits. If the file has fewer than 10 lines,
Get-Content outputs each line as it arrives, but waits until the tenth line arrives before
exiting.
You can interrupt Wait by pressing <kbd>Ctrl</kbd>+<kbd>C</kbd>. Deleting the file causes a
non-terminating error that also interrupts the waiting.
Wait is a dynamic parameter that the FileSystem provider adds to the Get-Content cmdlet. This parameter works only in file system drives. Wait can't be combined with Raw.What looks for it
highPotential Data Exfiltration Activity Via CommandLine ToolsNasreddine Bencherchali (Nextron Systems)
highPowerShell Execution With Potential Decryption CapabilitiesX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)