CmdID

CmdID / PowerShell / Cmdlets / New

New-Item

Creates a new item. PowerShell reference

From the PowerShell reference 18 parameters Alias ni 1 Sigma rule looks for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Creates a new item. The New-Item cmdlet creates a new item and sets its value. The types of items that can be created depend on the location of the item. For example, in the file system, New-Item creates files and folders. In the registry, New-Item creates registry keys and entries. New-Item can also set the value of the items that it creates. For example, when it creates a new file, New-Item can add initial content to the file.

New-Item [-Path] <string[]> [-ItemType <string>] [-Value <Object>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
New-Item [[-Path] <string[]>] -Name <string> [-ItemType <string>] [-Value <Object>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
New-Item [-Path] <string[]> -ConnectionURI <uri> [-ItemType <string>] [-Value <Object>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-OptionSet <hashtable>] [-Authentication <AuthenticationMechanism>] [-CertificateThumbprint <string>] [-SessionOption <SessionOption>] [-Port <int>] [<CommonParameters>]
New-Item [[-Path] <string[]>] -Name <string> [-ItemType <string>] [-Value <Object>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-OptionSet <hashtable>] [-Authentication <AuthenticationMechanism>] [-CertificateThumbprint <string>] [-SessionOption <SessionOption>] [-ApplicationName <string>] [-Port <int>] [-UseSSL] [<CommonParameters>]
New-Item [-Path] <string[]> [-ItemType <string>] [-Value <Object>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Options <ScopedItemOptions>] [<CommonParameters>]
New-Item [[-Path] <string[]>] -Name <string> [-ItemType <string>] [-Value <Object>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Options <ScopedItemOptions>] [<CommonParameters>]

Create a file in the current directory

New-Item -Path . -Name "testfile1.txt" -ItemType "File" -Value "This is a text string."Identify

Create a directory

New-Item -Path "C:\" -Name "logfiles" -ItemType "Directory"Identify

Create a profile

New-Item -Path $PROFILE -ItemType "File" -ForceIdentify

Create a directory in a different directory

New-Item -ItemType "Directory" -Path "C:\ps-test\scripts"Identify

Create multiple files

New-Item -ItemType "File" -Path "C:\ps-test\test.txt", "C:\ps-test\Logs\test.log"Identify

Use wildcards to create files in multiple directories

Get-ChildItem -Path C:\Temp\Identify

Create a symbolic link to a file or folder

$link = New-Item -ItemType SymbolicLink -Path .\link -Target .\Notice.txt $link | Select-Object LinkType, TargetIdentify

Use the -Force parameter to attempt to recreate folders

PS> New-Item -Path .\TestFolder -ItemType Directory PS> New-Item -Path .\TestFolder\TestFile.txt -ItemType File PS> New-Item -Path .\TestFolder -ItemType Directory -Force Directory: C:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/1/2020 8:03 AM TestFolder PS> Get-ChildItem .\TestFolder\ Directory: C:\TestFolder Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 5/1/2020 8:03 AM 0 TestFile.txtIdentify

Use the -Force parameter to overwrite existing files

PS> New-Item ./TestFile.txt -ItemType File -Value 'This is just a test file' Directory: C:\Source\Test Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 5/1/2020 8:32 AM 24 TestFile.txt New-Item ./TestFile.txt -ItemType File -Force Directory: C:\Source\Test Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 5/1/2020 8:32 AM 0 TestFile.txtIdentify

Its page in the reference: New-Item.

Parameters

18 in the PowerShell reference
Show its 18 parameters
-ApplicationNameThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Specifies the application name in the connection. The default value of the ApplicationName parameter is WSMAN. For more information, see New-WSManInstance.
-AuthenticationThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Specifies the authentication mechanism to be used at the server. For more information, see New-WSManInstance.
-CertificateThumbprintThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Specifies the digital public key certificate (X509) of a user account that has permission to perform this WSMan action. Enter the certificate thumbprint of the certificate. For more information, see New-WSManInstance.
-ConnectionURIThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Specifies the connection endpoint for WSMan. For more information, see New-WSManInstance.
-CredentialNOTE: This parameter isn't supported by any providers installed with PowerShell. To impersonate another user or elevate your credentials when running this cmdlet, use Invoke-Command.
-ForceForces this cmdlet to create an item that writes over an existing read-only item. Implementation varies from provider to provider. Even using the Force parameter, the cmdlet can't override security restrictions. You can't use Force to overwrite an existing Junction. Attempts to overwrite an existing Junction fail with a "cannot be removed because it is not empty" error. You must remove the existing Junction before creating a new one.
-ItemTypeSpecifies the provider-specified type of the new item. The available values of this parameter depend on the current provider you are using. If your location is in a FileSystem drive, the following values are allowed: - File - Directory - SymbolicLink - Junction - HardLink When you create a file using this method, the resulting file is encoded as UTF-8 without a byte-order-mark (BOM). In a Certificate drive, these are the values you can specify: - Certificate Provider - Certificate - Store - StoreLocation For more information see about_Providers.
-NameSpecifies the name of the new item. You can specify the name of the new item in the Name or Path parameter value, and you can specify the path of the new item in Name or Path value. Items names passed using the Name parameter are created relative to the value of the Path parameter.
-OptionsThis is a dynamic parameter made available by the Alias provider. For more information, see New-Alias. Specifies the value of the Options property of an alias. Valid values are: - None: The alias has no constraints (default value) - ReadOnly: The alias can be deleted but can't be changed without using the Force parameter - Constant: The alias can't be deleted or changed - Private: The alias is available only in the current scope - AllScope: The alias is copied to any new scopes that are created - Unspecified: The option isn't specified
-OptionSetThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Passes a set of switches to a service to modify or refine the nature of the request. For more information, see New-WSManInstance.
-PathSpecifies the path of the location of the new item. The default is the current location when Path is omitted. You can specify the name of the new item in Name, or include it in Path. Items names passed using the Name parameter are created relative to the value of the Path parameter. For this cmdlet, the Path parameter works like the LiteralPath parameter of other cmdlets. Wildcard characters are not interpreted. All characters are passed to the location's provider. The provider may not support all characters. For example, you can't create a filename that contains an asterisk (*) character.
-PortThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Specifies the port to use when the client connects to the WinRM service. For more information, see New-WSManInstance.
-SessionOptionThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Defines a set of extended options for the WS-Management session. For more information, see New-WSManInstance.
-UseSSLThis is a dynamic parameter made available by the WSMan provider. The WSMan provider and this parameter are only available on Windows. Specifies that the Secure Sockets Layer (SSL) protocol should be used to establish a connection to the remote computer. By default, SSL isn't used. For more information, see New-WSManInstance.
-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.
-ValueSpecifies the value of the new item. You can also pipe a value to New-Item.
-ConfirmPrompts you for confirmation before running the cmdlet.
-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.

What looks for it

Sigma process creation rules that name New-Item
highSecurity Event Logging Disabled via MiniNt Registry Key - ProcessSwachchhanda Shrawan Poudel (Nextron Systems)

See also

Clear-Item · Copy-Item · Get-Item · Invoke-Item · Move-Item · Remove-Item · Rename-Item · Set-Item