CmdID / PowerShell / Cmdlets / New
New-ItemProperty
Creates a new property for an item and sets its value. PowerShell reference
From the PowerShell reference 13 parameters 11 Sigma rules look for it
What it does
Creates a new property for an item and sets its value. The New-ItemProperty cmdlet creates a new property for a specified item and sets its value. Typically, this cmdlet is used to create new registry values, because registry values are properties of a registry key item. This cmdlet does not add properties to an object. - To add a property to an instance of an object, use the Add-Member cmdlet. - To add a property to all objects of a particular type, modify the Types.ps1xml file.
New-ItemProperty [-Path] <String[]> [-Name] <String> [-PropertyType <String>] [-Value <Object>] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]New-ItemProperty -LiteralPath <String[]> [-Name] <String> [-PropertyType <String>] [-Value <Object>] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Add a registry entry
New-ItemProperty -Path "HKLM:\Software\MyCompany" -Name "NoOfEmployees" -Value 822
Get-ItemProperty "HKLM:\Software\MyCompany"IdentifyAdd a registry entry to a key
Get-Item -Path "HKLM:\Software\MyCompany" | New-ItemProperty -Name NoOfLocations -Value 3IdentifyCreate a MultiString value in the registry using a Here-String
$newValue = New-ItemProperty -Path "HKLM:\SOFTWARE\ContosoCompany\" -Name 'HereString' -PropertyType MultiString -Value @"
This is text which contains newlines
It can also contain "quoted" strings
"@
$newValue.HereStringIdentifyCreate a MultiString value in the registry using an array
$newValue = New-ItemProperty -Path "HKLM:\SOFTWARE\ContosoCompany\" -Name 'MultiString' -PropertyType MultiString -Value ('a','b','c')
$newValue.MultiString[0]IdentifyIts page in the reference: New-ItemProperty.
Parameters
-CredentialSpecifies a user account that has permission to perform this action. The default is the current user.
NOTE: This parameter is not supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.-ExcludeSpecifies, as a string array, a property or property that this cmdlet excludes from the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted.-FilterSpecifies a filter in the format or language of the provider. The value of this parameter qualifies the Path parameter.
The syntax of the filter, including the use of wildcard characters, depends on the provider. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.-ForceForces the cmdlet to create a property on an object that cannot otherwise be accessed by the user. Implementation varies from provider to provider. For more information, see about_Providers.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks ('). Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
For more information, see about_Quoting_Rules.-NameSpecifies a name for the new property. If the property is a registry entry, this parameter specifies the name of the entry.-PathSpecifies the path of the item. This parameter identifies the item to which this cmdlet adds the new property.-PropertyTypeSpecifies the type of property that this cmdlet adds. The acceptable values for this parameter are:
- String: Specifies a null-terminated string. Used for REG_SZ values.
- ExpandString: Specifies a null-terminated string that contains unexpanded references to
environment variables that are expanded when the value is retrieved. Used for REG_EXPAND_SZ
values.
- Binary: Specifies binary data in any form. Used for REG_BINARY values.
- DWord: Specifies a 32-bit binary number. Used for REG_DWORD values.
- MultiString: Specifies an array of null-terminated strings terminated by two null characters.
Used for REG_MULTI_SZ values.
- Qword: Specifies a 64-bit binary number. Used for REG_QWORD values.
- Unknown: Indicates an unsupported registry data type, such as REG_RESOURCE_LIST values.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.-ValueSpecifies the property value. If the property is a registry entry, this parameter specifies the value of the entry.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.What looks for it
highHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highNon-privileged Usage of Reg or PowershellTeymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community
highSuspicious WSL InstallLocation Registry Key Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highSystem Restore Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highUser Shell Folders Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highVulnerable Driver Blocklist Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highWindows AMSI Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highWindows Credential Guard Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highWindows EventLog Autologger Session Registry Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
mediumLSA PPL Protection Setting Modification via CommandLineFlorian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
mediumRegistry Modification of MS-settings Protocol Handlerfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)