Select-String

Finds text in strings and files. PowerShell reference

From the PowerShell reference 14 parameters Alias sls 1 Sigma rule looks for it

What it does

from the PowerShell reference, CC BY 4.0

Finds text in strings and files. The Select-String cmdlet uses regular expression matching to search for text patterns in input strings and files. You can use Select-String similar to grep in Unix or findstr.exe in Windows. Select-String is based on lines of text. By default, Select-String finds the first match in each line and, for each match, it displays the file name, line number, and all text in the line containing the match. You can direct Select-String to find multiple matches per line, display text before and after the match, or display a Boolean value (True or False) that indicates whether a match is found. Select-String can display all the text matches or stop after the first match in each input file. Select-String can be used to display all text that doesn't match the specified pattern. You can also specify that Select-String should expect a particular character encoding, such as when you're searching files of Unicode text. Select-String uses the byte-order-mark (BOM) to detect the encoding format of the file. If the file has no BOM, it assumes the encoding is UTF8.

Select-String [-Pattern] <String[]> [-Path] <String[]> [-SimpleMatch] [-CaseSensitive] [-Quiet] [-List] [-Include <String[]>] [-Exclude <String[]>] [-NotMatch] [-AllMatches] [-Encoding <String>] [-Context <Int32[]>] [<CommonParameters>]

Select-String -InputObject <PSObject> [-Pattern] <String[]> [-SimpleMatch] [-CaseSensitive] [-Quiet] [-List] [-Include <String[]>] [-Exclude <String[]>] [-NotMatch] [-AllMatches] [-Encoding <String>] [-Context <Int32[]>] [<CommonParameters>]

Select-String [-Pattern] <String[]> -LiteralPath <String[]> [-SimpleMatch] [-CaseSensitive] [-Quiet] [-List] [-Include <String[]>] [-Exclude <String[]>] [-NotMatch] [-AllMatches] [-Encoding <String>] [-Context <Int32[]>] [<CommonParameters>]

Find a case-sensitive match

'Hello', 'HELLO' | Select-String -Pattern 'HELLO' -CaseSensitive -SimpleMatchIdentify

Find matches in text files

Get-Alias | Out-File -FilePath .\Alias.txt
Get-Command | Out-File -FilePath .\Command.txt
Select-String -Path .\*.txt -Pattern 'Get-'

Identify

Find a pattern match

Select-String -Path "$PSHOME\en-US\*.txt" -Pattern '\?'Identify

Use Select-String in a function

function Search-Help
{
$PSHelp = "$PSHOME\en-US\*.txt"
Select-String -Path $PSHelp -Pattern 'About_'
}

Search-Help

Identify

Search for a string in a Windows event log

$Events = Get-WinEvent -LogName Application -MaxEvents 50
$Events | Select-String -InputObject {$_.Message} -Pattern 'Failed'

Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Find a string in subdirectories

Get-ChildItem -Path C:\Windows\System32\*.txt -Recurse |
Select-String -Pattern 'Microsoft' -CaseSensitive

Identify

Find strings that do not match a pattern

Get-Command | Out-File -FilePath .\Command.txt
Select-String -Path .\Command.txt -Pattern 'Get', 'Set' -NotMatch

Identify

Find lines before and after a match

Get-Command | Out-File -FilePath .\Command.txt
Select-String -Path .\Command.txt -Pattern 'Get-Computer' -Context 2, 3

Identify

Find all pattern matches

$A = Get-ChildItem -Path "$PSHOME\en-US\*.txt" | Select-String -Pattern 'PowerShell'
$A

Identify

Example 10 - Convert pipeline objects to strings using Out-String

PS> $hash = @{
Name = 'foo'
Category = 'bar'
}

# !! NO output, due to .ToString() conversion
$hash | Select-String -Pattern 'foo'

# Out-String converts the output to a single multi-line string object
PS> $hash | Out-String | Select-String -Pattern 'foo'

Name Value
---- -----
Name foo
Category bar

# Out-String -Stream converts the output to a multiple single-line string objects
PS> $hash | Out-String -Stream | Select-String -Pattern 'foo'

Name foo

Identify

Its page in the reference: Select-String.

Parameters

14 in the PowerShell reference

-AllMatchesIndicates that the cmdlet searches for more than one match in each line of text. Without this parameter, Select-String finds only the first match in each line of text. When Select-String finds more than one match in a line of text, it still emits only one MatchInfo object for the line, but the Matches property of the object contains all the matches. NOTE: This parameter is ignored when used in combination with the SimpleMatch parameter. If you wish to return all matches and the pattern that you are searching for contains regular expression characters, you must escape those characters rather than using SimpleMatch. See about_Regular_Expressions for more information about escaping regular expressions.

-CaseSensitiveIndicates that the cmdlet matches are case-sensitive. By default, matches aren't case-sensitive.

-ContextCaptures the specified number of lines before and after the line that matches the pattern. If you enter one number as the value of this parameter, that number determines the number of lines captured before and after the match. If you enter two numbers as the value, the first number determines the number of lines before the match and the second number determines the number of lines after the match. For example, -Context 2,3. In the default display, lines with a match are indicated by a right angle bracket (>) (ASCII 62) in the first column of the display. Unmarked lines are the context. The Context parameter doesn't change the number of objects generated by Select-String. Select-String generates one MatchInfo object for each match. The context is stored as an array of strings in the Context property of the object. When the output of a Select-String command is sent down the pipeline to another Select-String command, the receiving command searches only the text in the matched line. The matched line is the value of the Line property of the MatchInfo object, not the text in the context lines. As a result, the Context parameter isn't valid on the receiving Select-String command. …

-EncodingSpecifies the type of encoding for the target file. The default value is default. The acceptable values for this parameter are as follows: - ascii Uses ASCII (7-bit) character set. - bigendianunicode Uses UTF-16 with the big-endian byte order. - default Uses the encoding that corresponds to the system's active code page (usually ANSI). - oem Uses the encoding that corresponds to the system's current OEM code page. - unicode Uses UTF-16 with the little-endian byte order. - utf7 Uses UTF-7. - utf8 Uses UTF-8. - utf32 Uses UTF-32 with the little-endian byte order.

-ExcludeExclude the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcards are permitted.

-IncludeIncludes the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcards are permitted.

-InputObjectSpecifies the text to be searched. Enter a variable that contains the text, or type a command or expression that gets the text. Using the InputObject parameter isn't the same as sending strings down the pipeline to Select-String. When you pipe more than one string to the Select-String cmdlet, it searches for the specified text in each string and returns each string that contains the search text. When you use the InputObject parameter to submit a collection of strings, Select-String treats the collection as a single combined string. Select-String returns the strings as a unit if it finds the search text in any string.

-ListOnly the first instance of matching text is returned from each input file. This is the most efficient way to retrieve a list of files that have contents matching the regular expression. By default, Select-String returns a MatchInfo object for each match it finds.

-LiteralPathSpecifies the path to the files to be searched. The value of the LiteralPath parameter is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. Paths containing spaces must be enclosed in quotes. For more information, see about_Quoting_Rules.

-NotMatchThe NotMatch parameter finds text that doesn't match the specified pattern.

-PathSpecifies the path to the files to search. Wildcards are permitted. The default location is the local directory. Specify files in the directory, such as log1.txt, *.doc, or *.*. If you specify only a directory, the command fails. Paths containing spaces must be enclosed in quotes. For more information, see about_Quoting_Rules.

-PatternSpecifies the text to find on each line. The pattern value is treated as a regular expression. The parameter accepts multiple patterns in an array. If you specify more than one pattern, Select-String returns matches for each pattern. To learn about regular expressions, see about_Regular_Expressions.

-QuietIndicates that the cmdlet returns a simple response instead of a MatchInfo object. The returned value is $true if the pattern is found or $null if the pattern is not found.

-SimpleMatchIndicates that the cmdlet uses a simple match rather than a regular expression match. In a simple match, Select-String searches the input for the text in the Pattern parameter. It doesn't interpret the value of the Pattern parameter as a regular expression statement. Also, when SimpleMatch is used, the Matches property of the MatchInfo object returned is empty. NOTE: When this parameter is used with the AllMatches parameter, the AllMatches is ignored.

What looks for it

Sigma process creation rules that name Select-String

mediumPotentially Suspicious JWT Token Search Via CLINasreddine Bencherchali (Nextron Systems), kagebunsher

Select-String

What it does

Parameters

What looks for it

See also