CmdID / PowerShell / Cmdlets / Out
Out-File
Sends output to a file. PowerShell reference
From the PowerShell reference 11 parameters 3 Sigma rules look for it
What it does
Sends output to a file. The Out-File cmdlet sends output to a file. It implicitly uses PowerShell's formatting system to write to the file. The file receives the same display representation as the terminal. This means that the output may not be ideal for programmatic processing unless all input objects are strings. When you need to specify parameters for the output, use Out-File rather than the redirection operator (>). For more information about redirection, see about_Redirection.
Out-File [-FilePath] <string> [[-Encoding] <string>] [-Append] [-Force] [-NoClobber] [-Width <int>] [-NoNewline] [-InputObject <psobject>] [-WhatIf] [-Confirm] [<CommonParameters>]Out-File [[-Encoding] <string>] -LiteralPath <string> [-Append] [-Force] [-NoClobber] [-Width <int>] [-NoNewline] [-InputObject <psobject>] [-WhatIf] [-Confirm] [<CommonParameters>]Send output and create a file
Get-Process | Out-File -FilePath .\Process.txt
Get-Content -Path .\Process.txtIdentifyPrevent an existing file from being overwritten
Get-Process | Out-File -FilePath .\Process.txt -NoClobberIdentifySend output to a file in ASCII format
$Procs = Get-Process
Out-File -FilePath .\Process.txt -InputObject $Procs -Encoding ascii -Width 50IdentifyUse a provider and send output to a file
PS> Set-Location -Path Alias:
PS> Get-Location
Path
----
Alias:\
PS> Get-ChildItem | Out-File -FilePath C:\TestDir\AliasNames.txt
PS> Get-Content -Path C:\TestDir\AliasNames.txt
CommandType Name
----------- ----
Alias % -> ForEach-Object
Alias ? -> Where-Object
Alias ac -> Add-Content
Alias cat -> Get-ContentIdentifySet file output width for entire scope
function DemoDefaultOutFileWidth() {
try {
$PSDefaultParameterValues['Out-File:Width'] = 2000
$logFile = "$PWD\logfile.txt"
Get-ChildItem Env:\ > $logFile
Get-Service -ErrorAction Ignore |
Format-Table -AutoSize |
Out-File $logFile -Append
Get-Process | Format-Table Id,SI,Name,Path,MainWindowTitle >> $logFile
}
finally {
$PSDefaultParameterValues.Remove('Out-File:Width')
}
}
DemoDefaultOutFileWidthIdentifyIts page in the reference: Out-File.
Parameters
-AppendAdds the output to the end of an existing file. If no Encoding is specified, the cmdlet uses the default encoding. That encoding may not match the encoding of the target file. This is the same behavior as the redirection operator (>>).-EncodingSpecifies the type of encoding for the target file. The default value is unicode.
The acceptable values for this parameter are as follows:
- ascii Uses ASCII (7-bit) character set.
- bigendianunicode Uses UTF-16 with the big-endian byte order.
- default Uses the encoding that corresponds to the system's active code page (usually ANSI).
- oem Uses the encoding that corresponds to the system's current OEM code page.
- string Same as unicode.
- unicode Uses UTF-16 with the little-endian byte order.
- unknown Same as unicode.
- utf7 Uses UTF-7.
- utf8 Uses UTF-8.
- utf32 Uses UTF-32 with the little-endian byte order.-FilePathSpecifies the path to the output file.-ForceOverrides the read-only attribute and overwrites an existing read-only file. The Force parameter doesn't override security restrictions.-InputObjectSpecifies the objects to be written to the file. Enter a variable that contains the objects or type a command or expression that gets the objects.-LiteralPathSpecifies the path to the output file. The LiteralPath parameter is used exactly as it's typed. Wildcard characters aren't accepted. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. For more information, see about_Quoting_Rules.-NoClobberNoClobber prevents an existing file from being overwritten and displays a message that the file already exists. By default, if a file exists in the specified path, Out-File overwrites the file without warning.-NoNewlineSpecifies that the content written to the file doesn't end with a newline character. The string representations of the input objects are concatenated to form the output. No spaces or newlines are inserted between the output strings. No newline is added after the last output string.-WidthSpecifies the maximum number of characters in each line of output. Any additional characters are truncated, not wrapped. If this parameter isn't used, the width is determined by the characteristics of the host. The default for the PowerShell console is 80 characters. If you want to control the width for all invocations of Out-File as well as the redirection operators (> and >>), set $PSDefaultParameterValues['Out-File:Width'] = 2000 before using Out-File.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.What looks for it
mediumComputer Discovery And Export Via Get-ADComputer CmdletNasreddine Bencherchali (Nextron Systems)
mediumPotentially Suspicious Powershell Script Execution From Temp FolderFlorian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton