sigcheck

sigcheck.exe -e -u -h <path>

Verifies the digital signature, hash, and version of binaries in a directory, detecting unsigned or spoofed executables.

Run it when you want to know if the binaries on a host are what they claim to be: sigcheck shows the signature (and its validity), the SHA-256 hash, the publisher, and the version of each executable. The -e mode scans only executables, -u lists unverified ones, and -h adds the hash. In an IR, scanning suspicious directories (Temp, user folders, app directories) with sigcheck separates the legitimate signed binary from the unsigned payload in seconds. It's also the tool to confirm if a legitimate binary was tampered with (the signature stops validating).

Don't use it as a security verdict: a signed binary can be malicious (stolen signatures, purchased certificates, or malware signed by accident) and an unsigned one can be legitimate (company's own software, development tools). The signature is a data point, not a sentence. In directories with many binaries, recursive scanning can take time and generate long lists — narrow the path. And note: sigcheck verifies the file on disk; malware only in memory or already deleted binaries won't appear.