Filter running processes by digital signature authority

Question

I want to write a script that will kill all processes whose executables are signed by a certain authority. I know how to get the list of running processes, and how to send a filtered list off to be killed. (Get-Process and Stop-Process, respectively.) But I don't know how to efficiently get the digital signature information for each process, or filter according to that signature.

I'm guessing the steps are going to be something like:

1. Get a list of all processes.
2. Use another cmdlet to get the digital signature of each process.
3. Use data from step 2 to filter by signature authority.
4. Send filtered list to Stop-Process.

However, this seems a bit inefficient in that I would like to avoid running commands across all processes any more than I need to. (e.g.: Making steps 2 and/or 3 part of step 1 instead would be nice.) Also, I just flat-out don't know how to do step 2.

So, essentially I have two questions here:

1. How do I get digital signature information for the executables associated with currently-running processes, in a way that can be used to filter the list?
2. Is there a way to do #1 without invoking a separate cmdlet after Get-Process? (Such as by just looking at properties of the objects delivered by Get-Process.)

Current environment is using PowerShell 4.0 on Windows 7 SP1. Notes about backward/forward-compatibility for given solutions are appreciated.

Answer 1

This will kill everything signed by Valve to increase your productivity:

Get-Process | Where-Object {
    (
         Get-AuthenticodeSignature -FilePath $_.MainModule.FileName
    ).SignerCertificate.Subject -like 'CN=Valve*'
} | Stop-Process

The Get-AuthenticodeSignature is available from PS 3.0 and higher. Alternatively, you could try to parse Sigcheck's output: Command to get name of signer from a .exe

Is there a way to do #1 without invoking a separate cmdlet after Get-Process? (Such as by just looking at properties of the objects delivered by Get-Process.)

I don't think so, because System.Diagnostics.ProcessModule has no properties that point to authenticode signatures.