CmdID / PowerShell / Cmdlets / Remove
Remove-ItemProperty
Deletes the property and its value from an item. PowerShell reference
From the PowerShell reference
11 parameters
Alias rp
1 Sigma rule looks for it
What it does
Deletes the property and its value from an item. The Remove-ItemProperty cmdlet deletes a property and its value from an item. You can use it to delete registry values and the data that they store.
Remove-ItemProperty [-Path] <String[]> [-Name] <String[]> [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Remove-ItemProperty -LiteralPath <String[]> [-Name] <String[]> [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Delete a registry value
Remove-ItemProperty -Path "HKLM:\Software\SmpApplication" -Name "SmpProperty"IdentifyDelete a registry value from the HKCU location
PS C:> Set-Location HKCU:\Software\MyCompany\MyApp
PS HKCU:\Software\MyCompany\MyApp> Remove-ItemProperty -Path . -Name "Options" -ConfirmIdentifyRemove a registry value by using the pipeline
Get-Item -Path HKLM:\Software\MyCompany | Remove-ItemProperty -Name NoOfEmployeesIdentifyIts page in the reference: Remove-ItemProperty.
Parameters
-CredentialNOTE: This parameter is not supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.-ExcludeSpecifies items that this cmdlet omits. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted.-FilterSpecifies a filter in the format or language of the provider. The value of this parameter qualifies the Path parameter.
The syntax of the filter, including the use of wildcard characters, depends on the provider. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.-ForceForces the cmdlet to remove a property of an object that cannot otherwise be accessed by the user. Implementation varies from provider to provider. For more information, see about_Providers.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted.-LiteralPathSpecifies the path to the current location of the property. Unlike the Path parameter, the value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.-NameSpecifies the names of the properties to remove. Wildcard characters are permitted.-PathSpecifies the path of the item whose properties are being removed. Wildcard characters are permitted.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.What looks for it
highWindows Credential Guard Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)