CmdID

CmdID / PowerShell / Cmdlets / New

New-Object

Creates an instance of a Microsoft .NET Framework or COM object. PowerShell reference

From the PowerShell reference 5 parameters 8 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Creates an instance of a Microsoft .NET Framework or COM object. The New-Object cmdlet creates an instance of a .NET Framework or COM object. You can specify either the type of a .NET Framework class or a ProgID of a COM object. By default, you type the fully qualified name of a .NET Framework class and the cmdlet returns a reference to an instance of that class. To create an instance of a COM object, use the ComObject parameter and specify the ProgID of the object as its value.

New-Object [-TypeName] <String> [[-ArgumentList] <Object[]>] [-Property <IDictionary>] [<CommonParameters>]
New-Object [-ComObject] <String> [-Strict] [-Property <IDictionary>] [<CommonParameters>]

Create a System.Version object

New-Object -TypeName System.Version -ArgumentList "1.2.3.4"Identify

Create an Internet Explorer COM object

$IE1 = New-Object -ComObject InternetExplorer.Application -Property @{Navigate2="www.microsoft.com"; Visible = $true} # The following command gets the same results as the example above. $IE2 = New-Object -ComObject InternetExplorer.Application $IE2.Navigate2("www.microsoft.com") $IE2.Visible = $trueIdentify

Use the Strict parameter to generate a non-terminating error

$A = New-Object -ComObject Word.Application -Strict -Property @{Visible = $true}Identify

Create a COM object to manage Windows desktop

$objShell = New-Object -ComObject "Shell.Application" $objShell | Get-Member $objShell.ToggleDesktop()Identify

Pass multiple arguments to a constructor

$array = @('One', 'Two', 'Three') $parameters = @{ TypeName = 'System.Collections.Generic.HashSet[string]' ArgumentList = ([string[]]$array, [System.StringComparer]::OrdinalIgnoreCase) } $set = New-Object @parametersIdentify

Calling a constructor that takes an array as a single parameter

$array = @('One', 'Two', 'Three') # This command throws an exception. $set = New-Object -TypeName 'System.Collections.Generic.HashSet[string]' -ArgumentList $array # This command succeeds. $set = New-Object -TypeName 'System.Collections.Generic.HashSet[string]' -ArgumentList (,[string[]]$array) $setIdentify

Its page in the reference: New-Object.

Parameters

5 in the PowerShell reference
-ArgumentListSpecifies an array of arguments to pass to the constructor of the .NET Framework class. If the constructor takes a single parameter that is an array, you must wrap that parameter inside another array. For example: For more information about the behavior of ArgumentList, see about_Splatting. The alias for ArgumentList is Args.
-ComObjectSpecifies the programmatic identifier (ProgID) of the COM object.
-PropertySets property values and invokes methods of the new object. Enter a hash table in which the keys are the names of properties or methods and the values are property values or method arguments. New-Object creates the object and sets each property value and invokes each method in the order that they appear in the hash table. If the new object is derived from the PSObject class, and you specify a property that does not exist on the object, New-Object adds the specified property to the object as a NoteProperty. If the object is not a PSObject, the command generates a non-terminating error.
-StrictIndicates that the cmdlet generates a non-terminating error when a COM object that you attempt to create uses an interop assembly. This feature distinguishes actual COM objects from .NET Framework objects with COM-callable wrappers.
-TypeNameSpecifies the fully qualified name of the .NET Framework class. You cannot specify both the TypeName parameter and the ComObject parameter.

What looks for it

Sigma process creation rules that name New-Object
criticalGreenbug Espionage Group IndicatorsFlorian Roth (Nextron Systems)
highHackTool - Covenant PowerShell LauncherFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
highLace Tempest Cobalt Strike DownloadNasreddine Bencherchali (Nextron Systems)
highPotential Baby Shark Malware ActivityFlorian Roth (Nextron Systems)
highSuspicious PowerShell Download and Execute PatternFlorian Roth (Nextron Systems)
mediumInvoke-Obfuscation COMPRESS OBFUSCATIONTimur Zinniatullin, oscd.community
mediumPowerShell Download PatternFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
mediumSuspicious PowerShell Invocations - Specific - ProcessCreationNasreddine Bencherchali (Nextron Systems)