Skip to content

Instantly share code, notes, and snippets.

@fraabye

fraabye/Get-Potential-Lolbins.ps1

Last active March 3, 2020 07:38
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save fraabye/4f217679e18b9b75aa595666bf150db3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save fraabye/4f217679e18b9b75aa595666bf150db3 to your computer and use it in GitHub Desktop.
Download ZIP
Get Potential Lolbins with PS
Raw
Get-Potential-Lolbins.ps1
# Gets all Microsoft-signed .exe files below c:\windows
Get-ChildItem C:\windows\ -File -recurse -Force -ErrorVariable FailedItems -ErrorAction SilentlyContinue|Where {$_.extension -eq ".exe" -And {$app = (Get-AuthenticodeSignature $_.FullName); if (![string]::IsNullOrEmpty($app.SignerCertificate.Subject)) {$app.SignerCertificate.Subject.Contains("Microsoft")}}}|Select -Expand Fullname
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment