Set-Content

PowerShell execution T1059.001

Write content to a file. Used to drop payloads, modify system files, or write scripts to disk for execution.

Binary Paths

  • PowerShell cmdlet

Glob Patterns

Pattern Wildcards Notes
& (gcm S*-C*t) -Path C:\payload.ps1 -Value $code
* Wildcards in both verb and noun
& (gcm Set-Con*) -Path ...
* Star matches 'tent'
& (gcm S?t-Content) -Path ...
? Single char wildcard replaces 'e'
& (gcm S[d-f]t-Content) -Path ...
[d-f] Character range matches 'e' in Set
& (gcm *-Content) -Path ...
* Prefix wildcard — note: also matches Get-Content
sc -Path C:\file.txt -Value 'data'
Alias 'sc' (note: conflicts with sc.exe service control)

Resources

← Back to Catalog