LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Sigverif.exe

View source

File Signature Verification utility to verify digital signatures of files

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Launch sigverif.exe GUI, click 'Advanced', specify arbitrary executable path as 'log file name', then click 'View Log' to execute the binary.

COMMAND
sigverif.exe
USE CASE
Execute arbitrary programs through a trusted Microsoft-signed binary to bypass application whitelisting.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 10, Windows 11
Execute · EXEApplication · GUI
02 / ON DISK

Known paths

C:\Windows\System32\sigverif.exe
C:\Windows\SysWOW64\sigverif.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    sigverif.exe spawning unexpected child processes

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Grzegorz Tworek@0gtweet
Adam@Hexacorn