Sigcheck description
Sigcheck verifies that images are digitally signed and dump version information
Verify that images are digitally signed and dump version information with p version information
Verify that images are digitally signed and dump version information with this simple command-line utility called Sigcheck.
Usage: sigcheck [-i][-e][[-s]|[-v]][-q][-u] [-c catalog file]
-c
Look for signature in the specified catalog file
-e
Scan executable images only (regardless of their extension)
-i
Show image signers
-n
Only show version number
-q
Quiet (no banner)
-s
Recurse subdirectories
-u
Show unsigned files only
-v
Csv output
One way to use the tool is to check for unsigned files in your WindowsSystem32 directories with this command:
sigcheck -u -e c:windowssystem32
You should investigate the purpose of any files that are not signed.
