Get-Content

PowerShell discovery T1005

Read file contents. Equivalent to cat on Linux. Used to read sensitive files, credentials, and configuration data.

Binary Paths

  • PowerShell cmdlet

Glob Patterns

Pattern Wildcards Notes
& (gcm G*-C*t) C:\Windows\System32\drivers\etc\hosts
* Wildcards in both verb and noun
& (gcm Get-Con*) ...
* Star matches 'tent'
& (gcm G?t-Content) ...
? Single char wildcard replaces 'e'
& (gcm G[d-f]t-Content) ...
[d-f] Character range matches 'e' in Get
gc C:\sensitive\file.txt
Built-in alias 'gc' for Get-Content
cat C:\sensitive\file.txt
Alias 'cat' also works in PowerShell
type C:\sensitive\file.txt
Alias 'type' also resolves to Get-Content
& (gcm *Content) ...
* Prefix wildcard

Resources

← Back to Catalog