Skip to content

Instantly share code, notes, and snippets.

@IISResetMe

IISResetMe/autoruns_timestamped.ps1

Created March 25, 2019 20:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save IISResetMe/4c4ff5d3f3096d1a60d8cf4ba9744125 to your computer and use it in GitHub Desktop.
Save IISResetMe/4c4ff5d3f3096d1a60d8cf4ba9744125 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
autoruns_timestamped.ps1
& autorunsc.exe * -c -nobanner |ConvertFrom-Csv |Select *,@{Label='HasTimestampedSignature';Expression={
[bool]$(if($_.'Image Path' -and $_.'Image Path' -notlike 'File not found:*'){
$sig = Get-AuthenticodeSignature $_.'Image Path'
$sig.Status -eq 'Valid' -and $sig.TimeStamperCertificate
})
}} |Export-Csv -Path output.csv -NoTypeInformation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment