I want to write a script that will kill all processes whose executables are signed by a certain authority. I know how to get the list of running processes, and how to send a filtered list off to be killed. (
Stop-Process, respectively.) But I don't know how to efficiently get the digital signature information for each process, or filter according to that signature.
I'm guessing the steps are going to be something like:
- Get a list of all processes.
- Use another cmdlet to get the digital signature of each process.
- Use data from step 2 to filter by signature authority.
- Send filtered list to Stop-Process.
However, this seems a bit inefficient in that I would like to avoid running commands across all processes any more than I need to. (e.g.: Making steps 2 and/or 3 part of step 1 instead would be nice.) Also, I just flat-out don't know how to do step 2.
So, essentially I have two questions here:
- How do I get digital signature information for the executables associated with currently-running processes, in a way that can be used to filter the list?
- Is there a way to do #1 without invoking a separate cmdlet after Get-Process? (Such as by just looking at properties of the objects delivered by Get-Process.)
Current environment is using PowerShell 4.0 on Windows 7 SP1. Notes about backward/forward-compatibility for given solutions are appreciated.