如何验证可执行文件是可靠的 ｜ Windows 应急响应

$file = 'c:\windows\system32\cmd.exe'

$microsoftCNS = @('Microsoft Corporation', 'Microsoft Windows')

# 获取可执行文件的数字签名
$signature = Get-AuthenticodeSignature -FilePath $file

if ($signature.Status -eq 'Valid') {
    Write-Output "文件的数字签名有效。"

    # 获取签名的发布者信息
    $publisher = $signature.SignerCertificate.Subject

    # $publisher = "CN=Microsoft Windows, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"

    # 解析发布者信息以提取 CN 字段的值
    $cnValues = @(($publisher -split ', ' | Where-Object { $_ -like 'CN=*' }).Substring(3))

    # 验证 CN 字段数量
    if ($cnValues.Count -eq 1) {
        $cnValue = $cnValues[0]
        Write-Output "CN 字段的值: $cnValue"

        # 判断 CN 字段是否为微软官方
        if ($microsoftCNS -contains $cnValue) {
            Write-Output "CN 字段值为微软官方。"
        } else {
            Write-Output "CN 字段值不是微软官方。"
        }
    } elseif ($cnValues.Count -gt 1) {
        Write-Output "错误：找到多个 CN 字段。"
    } else {
        Write-Output "错误：未找到 CN 字段。"
    }
} else {
    Write-Output "文件的数字签名无效。"
}

$rootPath = "C:\"

# 用于存储已发现的 CN 值和对应的文件地址
$cnFileMap = @{}

# 处理文件，获取 CN 值并记录对应的文件地址
function Process-File($file) {
    try {
        # 获取可执行文件的数字签名
        $signature = Get-AuthenticodeSignature -FilePath $file.FullName -ErrorAction Stop

        if ($signature -ne $null -and $signature.Status -eq 'Valid') {
            # 获取签名的发布者信息
            $publisher = $signature.SignerCertificate.Subject

            # 解析发布者信息以提取 CN 字段的值
            $cnValue = ($publisher -split ', ' | Where-Object { $_ -like 'CN=*' }).Substring(3)

            if ($cnValue) {
                if (-not $cnFileMap.ContainsKey($cnValue)) {
                    # 添加新的 CN 值到映射表
                    $cnFileMap[$cnValue] = $file.FullName
                }
            }
        }
    } catch {
        Write-Host "无法访问文件: $($file.FullName)"
    }
}

# 递归遍历目录并处理每个文件
Get-ChildItem -Path $rootPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $item = $_

    if ($item.PSIsContainer) {
        # 如果是目录，则继续递归遍历其中的文件
        Get-ChildItem -Path $item.FullName -File -ErrorAction SilentlyContinue | ForEach-Object {
            Process-File $_
        }
    } else {
        # 如果是文件，则直接处理
        Process-File $item
    }
}

# 打印所有的 CN 值
$cnValues = $cnFileMap.Keys
Write-Host "所有的 CN 值:"
Write-Host "-----------------------------------------------"
foreach ($cn in $cnValues) {
    Write-Host $cn
}
Write-Host "-----------------------------------------------"
Write-Host ""

# 打印每个 CN 值对应的文件地址
foreach ($cn in $cnValues) {
    Write-Host "CN 值: $cn"
    Write-Host "文件地址:"
    Write-Host "- $($cnFileMap[$cn])"
    Write-Host ""
}

所有的 CN 值:
-----------------------------------------------
Microsoft Windows Hardware Compatibility Publisher
Microsoft Corporation
Microsoft Windows
Microsoft Update
-----------------------------------------------

CN 值: Microsoft Windows Hardware Compatibility Publisher
文件地址:
- C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\windows-legacy-whql.cat

CN 值: Microsoft Corporation
文件地址:
- C:\Windows\System32\MpSigStub.exe

CN 值: Microsoft Windows
文件地址:
- C:\Windows\bfsvc.exe

CN 值: Microsoft Update
文件地址:
- C:\Windows\SoftwareDistribution\SIH\eng\SIHEng.dll

$file = 'c:\windows\system32\cmd.exe'

$microsoftCNS = @('Microsoft Corporation', 'Microsoft Windows', 'Microsoft Windows Hardware Compatibility Publisher', 'Microsoft Update')

# 获取可执行文件的数字签名
$signature = Get-AuthenticodeSignature -FilePath $file

if ($signature.Status -eq 'Valid') {
    Write-Output "文件的数字签名有效。"

    # 获取签名的发布者信息
    $publisher = $signature.SignerCertificate.Subject

    # $publisher = "CN=Microsoft Windows, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"

    # 解析发布者信息以提取 CN 字段的值
    $cnValues = @(($publisher -split ', ' | Where-Object { $_ -like 'CN=*' }).Substring(3))

    # 验证 CN 字段数量
    if ($cnValues.Count -eq 1) {
        $cnValue = $cnValues[0]
        Write-Output "CN 字段的值: $cnValue"

        # 判断 CN 字段是否为微软官方
        if ($microsoftCNS -contains $cnValue) {
            Write-Output "CN 字段值为微软官方。"
        } else {
            Write-Output "CN 字段值不是微软官方。"
        }
    } elseif ($cnValues.Count -gt 1) {
        Write-Output "错误：找到多个 CN 字段。"
    } else {
        Write-Output "错误：未找到 CN 字段。"
    }
} else {
    Write-Output "文件的数字签名无效。"
}

# 定义函数来进行签名校验
function Verify-FileSignature {
    param (
        [Parameter(Mandatory=$true)]
        [ValidateScript({Test-Path $_ -PathType Leaf})]
        [string]$FilePath
    )
    
    if (Test-Path -Path $FilePath -PathType Leaf) {
        $signature = Get-AuthenticodeSignature -FilePath $FilePath
        if ($signature.Status -eq 'Valid') {
            return "Valid"
        } else {
            return "Invalid"
        }
    } else {
        return "File Not Found"
    }
}

# 定义函数来检查注册表地址
function Check-RegistryPaths {
    param (
        [Parameter(Mandatory=$true)]
        [string[]]$RegistryPaths
    )

    $invalidSignatures = @()

    foreach ($registryPath in $RegistryPaths) {
        if (Test-Path -Path $registryPath) {
            $subkeys = Get-ChildItem -Path $registryPath
            foreach ($subkey in $subkeys) {
                $inprocServer32Path = Join-Path -Path $subkey.PSPath -ChildPath "InprocServer32"
                if (Test-Path -Path $inprocServer32Path) {
                    $defaultPropertyValue = (Get-ItemProperty -Path $inprocServer32Path -Name "(default)" -ErrorAction SilentlyContinue)."(default)"
                    if ($defaultPropertyValue) {
                        # 此处加 Trim('"') 是为了防止类似于 Defender 这种“有个性”的软件胡乱设置注册表
                        $binaryFilePath = $defaultPropertyValue.Trim().Trim('"')
                        $binaryFilePath = [Environment]::ExpandEnvironmentVariables($binaryFilePath)
                        if (Test-Path $binaryFilePath) {
                            $result = Verify-FileSignature -FilePath $binaryFilePath
                            if ($result -eq "Invalid") {
                                $invalidSignatures += @{
                                    RegistryPath = $subkey
                                    BinaryFilePath = $binaryFilePath
                                } 
                                Write-Host "Signature is invalid for file: $binaryFilePath" -ForegroundColor Red
                            } elseif ($result -eq "Valid") {
                                Write-Host "Signature is valid for file: $binaryFilePath " -ForegroundColor Green
                            }
                        } else {
                            $dllFileName = Split-Path -Leaf $binaryFilePath
                            $found = $false
                            $searchPaths = @(
                                (Join-Path -Path $env:SystemRoot -ChildPath $dllFileName),
                                (Join-Path -Path $env:SystemRoot -ChildPath "System32\$dllFileName")
                            )
                            foreach ($path in $searchPaths) {
                                if (Test-Path $path) {
                                    $found = $true
                                    $result = Verify-FileSignature -FilePath $path
                                    if ($result -eq "Invalid") {
                                        $invalidSignatures += @{
                                            RegistryPath = $subkey
                                            BinaryFilePath = $path
                                        }
                                        Write-Host "Signature is invalid for file: $path" -ForegroundColor Red
                                    } elseif ($result -eq "Valid") {
                                        Write-Host "Signature is valid for file: $path " -ForegroundColor Green
                                    }
                                    break
                                }
                            }
                            if (-not $found) {
                                Write-Host "Could not find file '$dllFileName' in default search paths. Skipping signature verification."  -ForegroundColor Yellow
                            }
                        }
                    } else {
                        Write-Host "Binary file path is empty for subkey $($subkey.PSChildName)."  -ForegroundColor Yellow
                    }
                }
            }
        }
    }

    # 打印不通过的签名验证信息
    if ($invalidSignatures.Count -gt 0) {
        Write-Output ""
        Write-Output ""
        Write-Output "--------------------------------------------------------"
        Write-Host "Invalid signatures:" -ForegroundColor Red
        foreach ($invalidSignature in $invalidSignatures) {
            $registryPath = $invalidSignature.RegistryPath
            $binaryFilePath = $invalidSignature.BinaryFilePath
            Write-Host "Registry path: $registryPath" -ForegroundColor Yellow
            Write-Host "Binary file path: $binaryFilePath" -ForegroundColor Yellow
            Write-Output ""
        }
        Write-Output "--------------------------------------------------------"
    }
}

# 要检查的注册表地址数组
$registryPaths = @(
    "Registry::HKEY_CURRENT_USER\Software\Classes\CLSID",
    "Registry::HKEY_CLASSES_ROOT\CLSID",
    "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\"
)

# 调用函数进行检查
Write-Host "Starting signature verification..."

Check-RegistryPaths -RegistryPaths $registryPaths

Write-Host "Signature verification completed."

$microsoftCNS = @('Microsoft Corporation', 'Microsoft Windows', 'Microsoft Windows Hardware Compatibility Publisher', 'Microsoft Update')

# 定义函数来进行签名校验
function Verify-FileSignature {
    param (
        [Parameter(Mandatory=$true)]
        [ValidateScript({Test-Path $_ -PathType Leaf})]
        [string]$FilePath
    )
    
    if (Test-Path -Path $FilePath -PathType Leaf) {
        $signature = Get-AuthenticodeSignature -FilePath $FilePath
        
        if ($signature.Status -eq 'Valid') {
            $publisher = $signature.SignerCertificate.Subject
            
            # 解析发布者信息以提取 CN 字段的值
            $cnValues = @(($publisher -split ', ' | Where-Object { $_ -like 'CN=*' }).Substring(3))

            if ($cnValues.Count -eq 1) {
                $cnValue = $cnValues[0]
                # Write-Output "CN 字段的值: $cnValue"
        
                # 判断 CN 字段是否为微软官方
                if ($microsoftCNS -contains $cnValue) {
                    # Write-Output "CN 字段值为微软官方。"
                    return "Valid"
                } 
            } 
        } 

        return "Invalid"

    } 
    
    return "File Not Found"

}

# 定义函数来检查注册表地址
function Check-RegistryPaths {
    param (
        [Parameter(Mandatory=$true)]
        [string[]]$RegistryPaths
    )

    $invalidSignatures = @()

    foreach ($registryPath in $RegistryPaths) {
        if (Test-Path -Path $registryPath) {
            $subkeys = Get-ChildItem -Path $registryPath
            foreach ($subkey in $subkeys) {
                $inprocServer32Path = Join-Path -Path $subkey.PSPath -ChildPath "InprocServer32"
                if (Test-Path -Path $inprocServer32Path) {
                    $defaultPropertyValue = (Get-ItemProperty -Path $inprocServer32Path -Name "(default)" -ErrorAction SilentlyContinue)."(default)"
                    if ($defaultPropertyValue) {
                        # 此处加 Trim('"') 是为了防止类似于 Defender 这种“有个性”的软件胡乱设置注册表
                        $binaryFilePath = $defaultPropertyValue.Trim().Trim('"')
                        $binaryFilePath = [Environment]::ExpandEnvironmentVariables($binaryFilePath)
                        if (Test-Path $binaryFilePath) {
                            $result = Verify-FileSignature -FilePath $binaryFilePath
                            if ($result -eq "Invalid") {
                                $invalidSignatures += @{
                                    RegistryPath = $subkey
                                    BinaryFilePath = $binaryFilePath
                                } 
                                Write-Host "Signature is invalid for file: $binaryFilePath" -ForegroundColor Red
                            } elseif ($result -eq "Valid") {
                                Write-Host "Signature is valid for file: $binaryFilePath " -ForegroundColor Green
                            }
                        } else {
                            $dllFileName = Split-Path -Leaf $binaryFilePath
                            $found = $false
                            $searchPaths = @(
                                (Join-Path -Path $env:SystemRoot -ChildPath $dllFileName),
                                (Join-Path -Path $env:SystemRoot -ChildPath "System32\$dllFileName")
                            )
                            foreach ($path in $searchPaths) {
                                if (Test-Path $path) {
                                    $found = $true
                                    $result = Verify-FileSignature -FilePath $path
                                    if ($result -eq "Invalid") {
                                        $invalidSignatures += @{
                                            RegistryPath = $subkey
                                            BinaryFilePath = $path
                                        }
                                        Write-Host "Signature is invalid for file: $path" -ForegroundColor Red
                                    } elseif ($result -eq "Valid") {
                                        Write-Host "Signature is valid for file: $path " -ForegroundColor Green
                                    }
                                    break
                                }
                            }
                            if (-not $found) {
                                Write-Host "Could not find file '$dllFileName' in default search paths. Skipping signature verification."  -ForegroundColor Yellow
                            }
                        }
                    } else {
                        Write-Host "Binary file path is empty for subkey $($subkey.PSChildName)."  -ForegroundColor Yellow
                    }
                }
            }
        }
    }

    # 打印不通过的签名验证信息
    if ($invalidSignatures.Count -gt 0) {
        Write-Output ""
        Write-Output ""
        Write-Output "--------------------------------------------------------"
        Write-Host "Invalid signatures:" -ForegroundColor Red
        foreach ($invalidSignature in $invalidSignatures) {
            $registryPath = $invalidSignature.RegistryPath
            $binaryFilePath = $invalidSignature.BinaryFilePath
            Write-Host "Registry path: $registryPath" -ForegroundColor Yellow
            Write-Host "Binary file path: $binaryFilePath" -ForegroundColor Yellow
            Write-Output ""
        }
        Write-Output "--------------------------------------------------------"
    }
}

# 要检查的注册表地址数组
$registryPaths = @(
    "Registry::HKEY_CURRENT_USER\Software\Classes\CLSID",
    "Registry::HKEY_CLASSES_ROOT\CLSID",
    "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\"
)

# 调用函数进行检查
Write-Host "Starting signature verification..."

Check-RegistryPaths -RegistryPaths $registryPaths

Write-Host "Signature verification completed."