Skip to content

Instantly share code, notes, and snippets.

@JeffMill
Created July 26, 2023 20:15
Show Gist options
  • Save JeffMill/aa8bde8e6e5b5b6a8b4bb614a6cce54a to your computer and use it in GitHub Desktop.
Save JeffMill/aa8bde8e6e5b5b6a8b4bb614a6cce54a to your computer and use it in GitHub Desktop.
Enumerate EXE and DLL signatures, returning Issuer and Subject.
# .\Get-Signatures.ps1 | Export-Csv -Path output.csv -NoTypeInformation
function Split-X500 {
Param([string]$X500)
$dict = @{}
$X500 -split ', ' | ForEach-Object {
$item = $_.Split('=')
$dict[$item[0]] = $item[1]
}
$dict
}
function Get-Signer {
Param([string]$Path)
$sig = Get-AuthenticodeSignature -FilePath $Path
$cert = $sig.SignerCertificate
[PSCustomObject]@{
Path = $Path
Status = $sig.Status
# e.g. 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
Subject = (Split-X500 -X500 $cert.Subject)['CN']
# e.g. 'CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
Issuer = (Split-X500 -X500 $cert.Issuer)['CN']
}
}
Get-ChildItem "$env:WINDIR" -File -Recurse -Include '*.dll','*.exe' -ErrorAction Continue | ForEach-Object {
Get-Signer -Path $_.FullName
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment