CmdID / PowerShell / Cmdlets / Import
Import-Clixml
Imports a CLIXML file and creates corresponding objects in PowerShell. PowerShell reference
From the PowerShell reference 5 parameters
What it does
Imports a CLIXML file and creates corresponding objects in PowerShell. The Import-Clixml cmdlet imports objects that have been serialized into a Common Language Infrastructure (CLI) XML file. A valuable use of Import-Clixml on Windows computers is to import credentials and secure strings that were exported as secure XML using Export-Clixml. Example #2 shows how to use Import-Clixml to import a secure credential object. The CLIXML data is deserialized back into PowerShell objects. However, the deserialized objects aren't a live objects. They are a snapshot of the objects at the time of serialization. The deserialized objects include properties but no methods. The TypeNames property contains the original type name prefixed with Deserialized. Example #3 show the TypeNames property of a deserialized object. Import-Clixml uses the byte-order-mark (BOM) to detect the encoding format of the file. If the file has no BOM, it assumes the encoding is UTF8. NOTE: [System.Management.Automation.ScriptBlock] objects are serialized into the <SKB> element in CLIXML. However, the <SKB> element is always deserialized to Strings. For more information about CLI, see Language independence.
Import-Clixml [-Path] <String[]> [-IncludeTotalCount] [-Skip <UInt64>] [-First <UInt64>] [<CommonParameters>]Import-Clixml -LiteralPath <String[]> [-IncludeTotalCount] [-Skip <UInt64>] [-First <UInt64>] [<CommonParameters>]Import a serialized file and recreate an object
Get-Process | Export-Clixml -Path .\pi.xml
$Processes = Import-Clixml -Path .\pi.xmlIdentifyImport a secure credential object
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential | Export-Clixml $Credxmlpath
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential = Import-Clixml $CredxmlpathIdentifyTrips 2 Sigma rules: highHackTool - CrackMapExec PowerShell Obfuscation by Thomas Patzke; lowPotential Encoded PowerShell Patterns In CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Inspect the TypeNames property of a deserialized object
$original = [pscustomobject] @{
Timestamp = Get-Date
Label = 'Meeting event'
}
$original | Add-Member -MemberType ScriptMethod -Name GetDisplay -Value {
'{0:yyyy-MM-dd HH:mm} {1}' -f $this.Timestamp, $this.Label
}
$original | Get-Member -MemberType ScriptMethodIdentifyIts page in the reference: Import-Clixml.
Parameters
-FirstGets only the specified number of objects. Enter the number of objects to get.-IncludeTotalCountReports the total number of objects in the data set followed by the selected objects. If the cmdlet can't determine the total count, it displays Unknown total count. The integer has an Accuracy property that indicates the reliability of the total count value. The value of Accuracy ranges from 0.0 to 1.0 where 0.0 means that the cmdlet couldn't count the objects, 1.0 means that the count is exact, and a value between 0.0 and 1.0 indicates an increasingly reliable estimate.-LiteralPathSpecifies the path to the XML files. Unlike Path, the value of the LiteralPath parameter is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.-PathSpecifies the path to the XML files.-SkipIgnores the specified number of objects and then gets the remaining objects. Enter the number of objects to skip.