CmdID

CmdID / PowerShell / Cmdlets / Set

Set-ItemProperty

Creates or changes the value of a property of an item. PowerShell reference

From the PowerShell reference 15 parameters Alias sp 11 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Creates or changes the value of a property of an item. The Set-ItemProperty cmdlet changes the value of the property of the specified item. You can use the cmdlet to establish or change the properties of items. For example, you can use Set-ItemProperty to set the value of the IsReadOnly property of a file object to $true. You also use Set-ItemProperty to create and change registry values and data. For example, you can add a new registry entry to a key and establish or change its value.

Set-ItemProperty [-Path] <string[]> [-Name] <string> [-Value] <Object> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
Set-ItemProperty [-Path] <string[]> -InputObject <psobject> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
Set-ItemProperty [-Name] <string> [-Value] <Object> -LiteralPath <string[]> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
Set-ItemProperty -LiteralPath <string[]> -InputObject <psobject> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]
Set-ItemProperty [-Path] <string[]> [-Name] <string> [-Value] <Object> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Type <RegistryValueKind>] [<CommonParameters>]
Set-ItemProperty [-Path] <string[]> -InputObject <psobject> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Type <RegistryValueKind>] [<CommonParameters>]
Set-ItemProperty [-Name] <string> [-Value] <Object> -LiteralPath <string[]> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Type <RegistryValueKind>] [<CommonParameters>]
Set-ItemProperty -LiteralPath <string[]> -InputObject <psobject> [-PassThru] [-Force] [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Type <RegistryValueKind>] [<CommonParameters>]

Set a property of a file

Set-ItemProperty -Path C:\GroupFiles\final.doc -Name IsReadOnly -Value $trueIdentify

Create a registry entry and value

Set-ItemProperty -Path "HKLM:\Software\ContosoCompany" -Name "NoOfEmployees" -Value 823 Get-ItemProperty -Path "HKLM:\Software\ContosoCompany"Identify

Modify an item by using the pipeline

Get-ChildItem weekly.txt | Set-ItemProperty -Name IsReadOnly -Value $trueIdentify

Its page in the reference: Set-ItemProperty.

Parameters

15 in the PowerShell reference
-CredentialNOTE: This parameter is not supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.
-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.
-ForceForces the cmdlet to set a property on items that cannot otherwise be accessed by the user. Implementation varies by provider. For more information, see about_Providers.
-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
-InputObjectSpecifies the object that has the properties that this cmdlet changes. Enter a variable that contains the object or a command that gets the object.
-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. For more information, see about_Quoting_Rules.
-NameSpecifies the name of the property.
-PassThruReturns an object that represents the item property. By default, this cmdlet does not generate any output.
-PathSpecifies the path of the items with the property to modify. Wildcard characters are permitted.
-TypeThis is a dynamic parameter made available by the Registry provider. The Registry provider and this parameter are only available on Windows. Specifies the type of property that this cmdlet adds. The acceptable values for this parameter are: - String: Specifies a null-terminated string. Used for REG_SZ values. - ExpandString: Specifies a null-terminated string that contains unexpanded references to environment variables that are expanded when the value is retrieved. Used for REG_EXPAND_SZ values. - Binary: Specifies binary data in any form. Used for REG_BINARY values. - DWord: Specifies a 32-bit binary number. Used for REG_DWORD values. - MultiString: Specifies an array of null-terminated strings terminated by two null characters. Used for REG_MULTI_SZ values. - Qword: Specifies a 64-bit binary number. Used for REG_QWORD values. - Unknown: Indicates an unsupported registry data type, such as REG_RESOURCE_LIST values.
-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.
-ValueSpecifies the value of the property.
-ConfirmPrompts you for confirmation before running the cmdlet.
-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.

What looks for it

Sigma process creation rules that name Set-ItemProperty
highHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highNon-privileged Usage of Reg or PowershellTeymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community
highSuspicious WSL InstallLocation Registry Key Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highSystem Restore Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highUser Shell Folders Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highVulnerable Driver Blocklist Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highWindows AMSI Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highWindows Credential Guard Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highWindows EventLog Autologger Session Registry Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
mediumLSA PPL Protection Setting Modification via CommandLineFlorian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
mediumRegistry Modification of MS-settings Protocol Handlerfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)

See also

Clear-ItemProperty · Copy-ItemProperty · Get-ItemProperty · Move-ItemProperty · New-ItemProperty · Remove-ItemProperty · Rename-ItemProperty