CmdID

CmdID / PowerShell / Cmdlets / Set

Set-Content

Writes new content or replaces existing content in a file. PowerShell reference

From the PowerShell reference 15 parameters Alias sc 2 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Writes new content or replaces existing content in a file. Set-Content is a string-processing cmdlet that writes new content or replaces the content in a file. Set-Content replaces the existing content and differs from the Add-Content cmdlet that appends content to a file. To send content to Set-Content you can use the Value parameter on the command line or send content through the pipeline. If you need to create files or directories for the following examples, see New-Item.

Set-Content [-Path] <string[]> [-Value] <Object[]> [-PassThru] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-NoNewline] [-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <string>] [<CommonParameters>]
Set-Content [-Value] <Object[]> -LiteralPath <string[]> [-PassThru] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-NoNewline] [-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <string>] [<CommonParameters>]
Set-Content [-Path] <string[]> [-Value] <Object[]> [-PassThru] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
Set-Content [-Value] <Object[]> -LiteralPath <string[]> [-PassThru] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]

Replace the contents of multiple files in a directory

Get-ChildItem -Path .\Test*.txtIdentify

Create a new file and write content

Set-Content -Path .\DateTime.txt -Value (Get-Date) Get-Content -Path .\DateTime.txtIdentify

Replace text in a file

Get-Content -Path .\Notice.txtIdentify

Use Filters with Set-Content

Set-Content -Path C:\Temp\* -Filter *.txt -Value "Empty"Identify

Its page in the reference: Set-Content.

Parameters

15 in the PowerShell reference
-CredentialNOTE: This parameter is not supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.
-EncodingThis is a dynamic parameter made available by the FileSystem provider. For more information, see about_FileSystem_Provider. Specifies the type of encoding for the target file. The default value is Default. Encoding is a dynamic parameter that the FileSystem provider adds to Set-Content. This parameter works only in file system drives. The acceptable values for this parameter are as follows: - Ascii Uses ASCII (7-bit) character set. - BigEndianUnicode Uses UTF-16 with the big-endian byte order. - BigEndianUTF32 Uses UTF-32 with the big-endian byte order. - Byte Encodes a set of characters into a sequence of bytes. - Default Uses the encoding that corresponds to the system's active code page (usually ANSI). - Oem Uses the encoding that corresponds to the system's current OEM code page. - String Same as Unicode. - Unicode Uses UTF-16 with the little-endian byte order. - Unknown Same as Unicode. - UTF7 Uses UTF-7. - UTF8 Uses UTF-8. - UTF32 Uses UTF-32 with the little-endian byte order. Encoding is a dynamic parameter that the FileSystem provider adds to Set-Content. This parameter works only in file system drives.
-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.
-ForceForces the cmdlet to set the contents of a file, even if the file is read-only. Implementation varies from provider to provider. For more information, see about_Providers. The Force parameter does not override security restrictions.
-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. For more information, see about_Quoting_Rules.
-NoNewlineThis is a dynamic parameter made available by the FileSystem provider. For more information, see about_FileSystem_Provider. The string representations of the input objects are concatenated to form the output. No spaces or newlines are inserted between the output strings. No newline is added after the last output string.
-PassThruReturns an object that represents the content. By default, this cmdlet does not generate any output.
-PathSpecifies the path of the item that receives the content. Wildcard characters are permitted.
-StreamThis is a dynamic parameter made available by the FileSystem provider. This Parameter is only available on Windows. For more information, see about_FileSystem_Provider. Specifies an alternative data stream for content. If the stream does not exist, this cmdlet creates it. Wildcard characters are not supported. Stream is a dynamic parameter that the FileSystem provider adds to Set-Content. This parameter works only in file system drives. You can use the Set-Content cmdlet to create or update the content of any alternate data stream, such as Zone.Identifier. However, we do not recommend this as a way to eliminate security checks that block files that are downloaded from the Internet. If you verify that a downloaded file is safe, use the Unblock-File cmdlet. This parameter was introduced in PowerShell 3.0.
-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.
-ValueSpecifies the new content for the item.
-ConfirmPrompts you for confirmation before running the cmdlet.
-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.

What looks for it

Sigma process creation rules that name Set-Content
mediumComputer Discovery And Export Via Get-ADComputer CmdletNasreddine Bencherchali (Nextron Systems)
mediumUser Discovery And Export Via Get-ADUser CmdletNasreddine Bencherchali (Nextron Systems)

See also

Add-Content · Clear-Content · Get-ChildItem · Get-Content · ForEach-Object · New-Item