authenticode

File (executable, bundle, installer, disk) code signing status.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: authenticode

  • Windows

Table schema

Name

Type

Description

path

TEXT

Must provide a path or directory

original_program_name

TEXT

The original program name that the publisher has signed

serial_number

TEXT

The certificate serial number

issuer_name

TEXT

The certificate issuer name

subject_name

TEXT

The certificate subject name

result

TEXT

The signature check result

Query examples

SELECT * FROM authenticode WHERE path = 'C:\Windows\notepad.exe'
SELECT process.pid, process.path, signature.result FROM processes as process LEFT JOIN authenticode AS signature ON process.path = signature.path;