CmdID

CmdID / PowerShell / Cmdlets / Import

Import-Module

Adds modules to the current session. PowerShell reference

From the PowerShell reference 24 parameters Alias ipmo 4 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Adds modules to the current session. The Import-Module cmdlet adds one or more modules to the current session. Starting in PowerShell 3.0, installed modules are automatically imported to the session when you use any commands or providers in the module. However, you can still use the Import-Module command to import a module. You can disable automatic module importing using the $PSModuleAutoLoadingPreference preference variable. For more information about the $PSModuleAutoLoadingPreference variable, see about_Preference_Variables. A module is a package that contains members that can be used in PowerShell. Members include cmdlets, providers, scripts, functions, variables, and other tools and files. After a module is imported, you can use the module members in your session. For more information about modules, see about_Modules. By default, Import-Module imports all members that the module exports, but you can use the Alias, Function, Cmdlet, and Variable parameters to restrict which members are imported. The NoClobber parameter prevents Import-Module from importing members that have the same names as members in the current session. Import-Module imports a module only into the current session. To import the module into every new session, add an Import-Module command to your PowerShell profile. For more information about profiles, see about_Profiles. You can manage remote Windows computers that have PowerShell remoting enabled by creating a PSSession on the remote computer. Then use the PSSession parameter of Import-Module to import the modules that are installed on the remote computer. When you use the imported commands in the current session the commands implicitly run on the remote computer. Starting in Windows PowerShell 3.0, you can use Import-Module to import Common Information Model (CIM) modules. CIM modules define cmdlets in Cmdlet Definition XML (CDXML) files. This feature lets you use cmdlets that are implemented in non-managed code assemblies, such as those written in C++. For remote computers that don't have PowerShell remoting enabled, including computers that aren't running the Windows operating system, you can use the CimSession parameter of Import-Module to import CIM modules from the remote computer. The imported commands run implicitly on the remote computer. …

Import-Module [-Global] [-Prefix <String>] [-Name] <String[]> [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-MinimumVersion <Version>] [-MaximumVersion <String>] [-RequiredVersion <Version>] [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] [<CommonParameters>]
Import-Module [-Global] [-Prefix <String>] [-Name] <String[]> [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-MinimumVersion <Version>] [-MaximumVersion <String>] [-RequiredVersion <Version>] [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] -PSSession <PSSession> [<CommonParameters>]
Import-Module [-Global] [-Prefix <String>] [-Name] <String[]> [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-MinimumVersion <Version>] [-MaximumVersion <String>] [-RequiredVersion <Version>] [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] -CimSession <CimSession> [-CimResourceUri <Uri>] [-CimNamespace <String>] [<CommonParameters>]
Import-Module [-Global] [-Prefix <String>] [-FullyQualifiedName] <ModuleSpecification[]> [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] [<CommonParameters>]
Import-Module [-Global] [-Prefix <String>] [-FullyQualifiedName] <ModuleSpecification[]> [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] -PSSession <PSSession> [<CommonParameters>]
Import-Module [-Global] [-Prefix <String>] [-Assembly] <Assembly[]> [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] [<CommonParameters>]
Import-Module [-Global] [-Prefix <String>] [-Function <String[]>] [-Cmdlet <String[]>] [-Variable <String[]>] [-Alias <String[]>] [-Force] [-PassThru] [-AsCustomObject] [-ModuleInfo] <PSModuleInfo[]> [-ArgumentList <Object[]>] [-DisableNameChecking] [-NoClobber] [-Scope <String>] [<CommonParameters>]

Import the members of a module into the current session

Import-Module -Name PSDiagnosticsIdentify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Import all modules specified by the module path

Get-Module -ListAvailable | Import-ModuleIdentify

Import the members of several modules into the current session

$m = Get-Module -ListAvailable PSDiagnostics, Dism Import-Module -ModuleInfo $mIdentify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Import all modules specified by a path

Import-Module -Name C:\ps-test\modules\test -VerboseIdentify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Restrict module members imported into a session

Import-Module PSDiagnostics -Function Disable-PSTrace, Enable-PSTrace (Get-Module PSDiagnostics).ExportedCommandsIdentify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Import the members of a module and add a prefix

Import-Module PSDiagnostics -Prefix x -PassThruIdentify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Get and use a custom object

Get-Module -List | Format-Table -Property Name, ModuleType -AutoSizeIdentify

Reimport a module into the same session

Import-Module PSDiagnostics Import-Module PSDiagnostics -Force -Prefix PSIdentify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Run commands that have been hidden by imported commands

Get-DateIdentify

Import a minimum version of a module

Import-Module -Name PowerShellGet -MinimumVersion 2.0.0Identify

Trips 1 Sigma rule: lowImport New Module Via PowerShell CommandLine by Nasreddine Bencherchali (Nextron Systems)

Its page in the reference: Import-Module.

Parameters

24 in the PowerShell reference
Show its 24 parameters
-AliasSpecifies the aliases that this cmdlet imports from the module into the current session. Enter a comma-separated list of aliases. Wildcard characters are permitted. Some modules automatically export selected aliases into your session when you import the module. This parameter lets you select from among the exported aliases.
-ArgumentListSpecifies an array of arguments, or parameter values, that are passed to a script module during the Import-Module command. This parameter is valid only when you're importing a script module. You can also refer to the ArgumentList parameter by its alias, args. For more information about the behavior of ArgumentList, see about_Splatting.
-AsCustomObjectIndicates that this cmdlet returns a custom object with members that represent the imported module members. This parameter is valid only for script modules. When you use the AsCustomObject parameter, Import-Module imports the module members into the session and then returns a PSCustomObject object instead of a PSModuleInfo object. You can save the custom object in a variable and use member-access enumeration to invoke the members.
-AssemblySpecifies an array of assembly objects. This cmdlet imports the cmdlets and providers implemented in the specified assembly objects. Enter a variable that contains assembly objects or a command that creates assembly objects. You can also pipe an assembly object to Import-Module. When you use this parameter, only the cmdlets and providers implemented by the specified assemblies are imported. If the module contains other files, they aren't imported, and you might be missing important members of the module. Use this parameter for debugging and testing the module, or when you're instructed to use it by the module author.
-CimNamespaceSpecifies the namespace of an alternate CIM provider that exposes CIM modules. The default value is the namespace of the Module Discovery WMI provider. Use this parameter to import CIM modules from computers and devices that aren't running a Windows operating system. This parameter was introduced in Windows PowerShell 3.0.
-CimResourceUriSpecifies an alternate location for CIM modules. The default value is the resource URI of the Module Discovery WMI provider on the remote computer. Use this parameter to import CIM modules from computers and devices that aren't running a Windows operating system. This parameter was introduced in Windows PowerShell 3.0.
-CimSessionSpecifies a CIM session on the remote computer. Enter a variable that contains the CIM session or a command that gets the CIM session, such as a Get-CimSession command. Import-Module uses the CIM session connection to import modules from the remote computer into the current session. When you use the commands from the imported module in the current session, the commands run on the remote computer. You can use this parameter to import modules from computers and devices that aren't running the Windows operating system, and Windows computers that have PowerShell, but don't have PowerShell remoting enabled. This parameter was introduced in Windows PowerShell 3.0.
-CmdletSpecifies an array of cmdlets that this cmdlet imports from the module into the current session. Wildcard characters are permitted. Some modules automatically export selected cmdlets into your session when you import the module. This parameter lets you select from among the exported cmdlets.
-DisableNameCheckingIndicates that this cmdlet suppresses the message that warns you when you import a cmdlet or function whose name includes an unapproved verb or a prohibited character. By default, when a module that you import exports cmdlets or functions that have unapproved verbs in their names, PowerShell displays the following warning message: WARNING: Some imported command names include unapproved verbs which might make them less discoverable. Use the Verbose parameter for more detail or type Get-Verb to see the list of approved verbs. This message is only a warning. The complete module is still imported, including the non-conforming commands. Although the message is displayed to module users, the naming problem should be fixed by the module author.
-ForceThis parameter causes a module to be loaded, or reloaded, over top of the current one. Some modules load external assemblies. The import fails if you are importing a module that loads a newer version of an assembly. The Force parameter can't override the error. You must start a new session to load the new version.
-FullyQualifiedNameThe value can be a module name, a full module specification, or a path to a module file. When the value is a path, the path can be fully qualified or relative. A relative path is resolved relative to the script that contains the using statement. When the value is a name or module specification, PowerShell searches the PSModulePath for the specified module. A module specification is a hashtable that has the following keys. - ModuleName - Required Specifies the module name. - GUID - Optional Specifies the GUID of the module. - It's also Required to specify at least one of the three below keys. - ModuleVersion - Specifies a minimum acceptable version of the module. - MaximumVersion - Specifies the maximum acceptable version of the module. - RequiredVersion - Specifies an exact, required version of the module. This can't be used with the other Version keys.
-FunctionSpecifies an array of functions that this cmdlet imports from the module into the current session. Wildcard characters are permitted. Some modules automatically export selected functions into your session when you import the module. This parameter lets you select from among the exported functions.
-GlobalIndicates that this cmdlet imports modules into the global session state so they're available to all commands in the session. By default, when Import-Module cmdlet is called from the command prompt, script file, or scriptblock, all the commands are imported into the global session state. When invoked from another module, Import-Module cmdlet imports the commands in a module, including commands from nested modules, into the calling module's session state. TIP: You should avoid calling Import-Module from within a module. Instead, declare the target module as a nested module in the parent module's manifest. Declaring nested modules improves the discoverability of dependencies. The Global parameter is equivalent to the Scope parameter with a value of Global. To restrict the commands that a module exports, use an Export-ModuleMember command in the script module.
-MaximumVersionSpecifies a maximum version. This cmdlet imports only a version of the module that's less than or equal to the specified value. If no version qualifies, Import-Module returns an error.
-MinimumVersionSpecifies a minimum version. This cmdlet imports only a version of the module that's greater than or equal to the specified value. Use the MinimumVersion parameter name or its alias, Version. If no version qualifies, Import-Module generates an error. To specify an exact version, use the RequiredVersion parameter. You can also use the Module and Version parameters of the #Requires keyword to require a specific version of a module in a script. This parameter was introduced in Windows PowerShell 3.0.
-ModuleInfoSpecifies an array of module objects to import. Enter a variable that contains the module objects, or a command that gets the module objects, such as the following command: Get-Module -ListAvailable. You can also pipe module objects to Import-Module.
-NameSpecifies the names of the modules to import. Enter the name of the module or the name of a file in the module, such as a .psd1, .psm1, .dll, or .ps1 file. File paths are optional. Wildcard characters aren't permitted. You can also pipe module names and filenames to Import-Module. If you omit a path, Import-Module looks for the module in the paths saved in the $Env:PSModulePath environment variable. Specify only the module name whenever possible. When you specify a filename, only the members that are implemented in that file are imported. If the module contains other files, they aren't imported, and you might be missing important members of the module. NOTE: While it's possible to import a script (.ps1) file as a module, script files are usually not structured like script modules file (.psm1) file. Importing a script file doesn't guarantee that it's usable as a module. For more information, see about_Modules.
-NoClobberPrevents importing commands that have the same names as existing commands in the current session. By default, Import-Module imports all exported module commands. Commands that have the same names can hide or replace commands in the session. To avoid command name conflicts in a session, use the Prefix or NoClobber parameters. For more information about name conflicts and command precedence, see "Modules and Name Conflicts" in about_Modules and about_Command_Precedence. This parameter was introduced in Windows PowerShell 3.0.
-PassThruReturns an object representing the imported module. By default, this cmdlet doesn't generate any output.
-PrefixSpecifies a prefix that this cmdlet adds to the nouns in the names of imported module members. Use this parameter to avoid name conflicts that might occur when different members in the session have the same name. This parameter doesn't change the module, and it doesn't affect files that the module imports for its own use. These are known as nested modules. This cmdlet affects only the names of members in the current session. For example, if you specify the prefix UTC and then import a Get-Date cmdlet, the cmdlet is known in the session as Get-UTCDate, and it's not confused with the original Get-Date cmdlet. The value of this parameter takes precedence over the DefaultCommandPrefix property of the module, which specifies the default prefix.
-PSSessionSpecifies a PowerShell user-managed session (PSSession) from which this cmdlet imports modules into the current session. Enter a variable that contains a PSSession or a command that gets a PSSession, such as a Get-PSSession command. When you import a module from a different session into the current session, you can use the cmdlets from the module in the current session, just as you would use cmdlets from a local module. Commands that use the remote cmdlets run in the remote session, but the remoting details are managed in the background by PowerShell. This parameter uses the Implicit Remoting feature of PowerShell. It's equivalent to using the Import-PSSession cmdlet to import particular modules from a session. Import-Module can't import core PowerShell modules from another session. The core PowerShell modules have names that begin with Microsoft.PowerShell. This parameter was introduced in Windows PowerShell 3.0.
-RequiredVersionSpecifies a version of the module that this cmdlet imports. If the version isn't installed, Import-Module generates an error. By default, Import-Module imports the module without checking the version number. To specify a minimum version, use the MinimumVersion parameter. You can also use the Module and Version parameters of the #Requires keyword to require a specific version of a module in a script. This parameter was introduced in Windows PowerShell 3.0. Scripts that use RequiredVersion to import modules that are included with existing releases of the Windows operating system don't automatically run in future releases of the Windows operating system. This is because PowerShell module version numbers in future releases of the Windows operating system are higher than module version numbers in existing releases of the Windows operating system.
-ScopeSpecifies a scope to import the module in. The acceptable values for this parameter are: - Global. Available to all commands in the session. Equivalent to the Global parameter. - Local. Available only in the current scope. By default, when Import-Module cmdlet is called from the command prompt, script file, or scriptblock, all the commands are imported into the global session state. You can use the -Scope Local parameter to import module content into the script or scriptblock scope. When invoked from another module, Import-Module cmdlet imports the commands in a module, including commands from nested modules, into the caller's session state. Specifying -Scope Global or -Global indicates that this cmdlet imports modules into the global session state so they're available to all commands in the session. The Global parameter is equivalent to the Scope parameter with a value of Global. This parameter was introduced in Windows PowerShell 3.0.
-VariableSpecifies an array of variables that this cmdlet imports from the module into the current session. Enter a list of variables. Wildcard characters are permitted. Some modules automatically export selected variables into your session when you import the module. This parameter lets you select from among the exported variables.

What looks for it

Sigma process creation rules that name Import-Module
mediumImport PowerShell Modules From Suspicious Directories - ProcCreationNasreddine Bencherchali (Nextron Systems)
mediumSuspicious WindowsTerminal Child ProcessesNasreddine Bencherchali (Nextron Systems)
lowImport New Module Via PowerShell CommandLineNasreddine Bencherchali (Nextron Systems)