CmdID / PowerShell / Cmdlets / Get
Get-ItemProperty
Gets the properties of a specified item. PowerShell reference
From the PowerShell reference
8 parameters
Alias gp
2 Sigma rules look for it
What it does
Gets the properties of a specified item. The Get-ItemProperty cmdlet gets the properties of the specified items. For example, you can use this cmdlet to get the value of the LastAccessTime property of a file object. You can also use this cmdlet to view registry entries and their values.
Get-ItemProperty [-Path] <String[]> [[-Name] <String[]>] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-UseTransaction] [<CommonParameters>]Get-ItemProperty -LiteralPath <String[]> [[-Name] <String[]>] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-UseTransaction] [<CommonParameters>]Get information about a specific directory
Get-ItemProperty C:\WindowsIdentifyGet the properties of a specific file
Get-ItemProperty C:\Test\Weather.xls | Format-ListIdentifyGet the value name and data of a registry entry in a registry subkey
Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name "ProgramFilesDir"IdentifyGet the value names and data of registry entries in a registry key
Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngineIdentifyIts page in the reference: Get-ItemProperty.
Parameters
-CredentialNOTE: This parameter is not supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-LiteralPathSpecifies the path to the current location of the property. The value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks ('). Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
For more information, see about_Quoting_Rules.-NameSpecifies the name of the property or properties to retrieve.-PathSpecifies the path to the item or items.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.What looks for it
highScheduled Task Executing Encoded Payload from RegistrypH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
mediumScheduled Task Executing Payload from RegistryX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)