Created
July 26, 2023 20:15
-
-
Save JeffMill/aa8bde8e6e5b5b6a8b4bb614a6cce54a to your computer and use it in GitHub Desktop.
Enumerate EXE and DLL signatures, returning Issuer and Subject.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# .\Get-Signatures.ps1 | Export-Csv -Path output.csv -NoTypeInformation | |
function Split-X500 { | |
Param([string]$X500) | |
$dict = @{} | |
$X500 -split ', ' | ForEach-Object { | |
$item = $_.Split('=') | |
$dict[$item[0]] = $item[1] | |
} | |
$dict | |
} | |
function Get-Signer { | |
Param([string]$Path) | |
$sig = Get-AuthenticodeSignature -FilePath $Path | |
$cert = $sig.SignerCertificate | |
[PSCustomObject]@{ | |
Path = $Path | |
Status = $sig.Status | |
# e.g. 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' | |
Subject = (Split-X500 -X500 $cert.Subject)['CN'] | |
# e.g. 'CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' | |
Issuer = (Split-X500 -X500 $cert.Issuer)['CN'] | |
} | |
} | |
Get-ChildItem "$env:WINDIR" -File -Recurse -Include '*.dll','*.exe' -ErrorAction Continue | ForEach-Object { | |
Get-Signer -Path $_.FullName | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment