0

I want to write a script that will kill all processes whose executables are signed by a certain authority. I know how to get the list of running processes, and how to send a filtered list off to be killed. (Get-Process and Stop-Process, respectively.) But I don't know how to efficiently get the digital signature information for each process, or filter according to that signature.

I'm guessing the steps are going to be something like:

  1. Get a list of all processes.
  2. Use another cmdlet to get the digital signature of each process.
  3. Use data from step 2 to filter by signature authority.
  4. Send filtered list to Stop-Process.

However, this seems a bit inefficient in that I would like to avoid running commands across all processes any more than I need to. (e.g.: Making steps 2 and/or 3 part of step 1 instead would be nice.) Also, I just flat-out don't know how to do step 2.

So, essentially I have two questions here:

  1. How do I get digital signature information for the executables associated with currently-running processes, in a way that can be used to filter the list?
  2. Is there a way to do #1 without invoking a separate cmdlet after Get-Process? (Such as by just looking at properties of the objects delivered by Get-Process.)

Current environment is using PowerShell 4.0 on Windows 7 SP1. Notes about backward/forward-compatibility for given solutions are appreciated.

0

This will kill everything signed by Valve to increase your productivity:

Get-Process | Where-Object {
    (
         Get-AuthenticodeSignature -FilePath $_.MainModule.FileName
    ).SignerCertificate.Subject -like 'CN=Valve*'
} | Stop-Process

The Get-AuthenticodeSignature is available from PS 3.0 and higher. Alternatively, you could try to parse Sigcheck's output: Command to get name of signer from a .exe

Is there a way to do #1 without invoking a separate cmdlet after Get-Process? (Such as by just looking at properties of the objects delivered by Get-Process.)

I don't think so, because System.Diagnostics.ProcessModule has no properties that point to authenticode signatures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.