File Signature Verification (sigverif)

Run: sigverif.exe

Overview

Scans Windows system files and loaded drivers to verify their digital signatures. Identifies files that are unsigned, have invalid signatures, or have expired signatures. Results are logged to a text file for review.

How It Works

Scans %SystemRoot%\System32 and driver directories. Compares each file against the Windows Driver Signing catalog (.cat files) and Authenticode signatures. Flags any file that does not have a valid, trusted signature.

Results Log

%SystemRoot%\sigverif.txt

Open after the scan completes to review flagged files.

IT and Security Uses

After a suspected system compromise, run sigverif to identify unsigned files in system directories that should not be there. Unsigned .sys files in C:\Windows\System32\drivers\ are a strong indicator of:

• Rootkit or kernel-level malware
• Unsigned third-party drivers (may be legitimate but warrant investigation)
• Tampered system files

Better Alternatives (Sysinternals)

SigCheck provides far more granular signature verification with VirusTotal integration:

# Check all unsigned executables in System32 (recursive):
sigcheck -u -e C:\Windows\System32

# Check a specific file and query VirusTotal:
sigcheck -v C:\Windows\System32\suspicious.dll

# Export results to CSV:
sigcheck -u -e -c C:\Windows\System32 > unsigned_files.csv

PowerShell

# Check signature status of all EXEs in System32:
Get-AuthenticodeSignature C:\Windows\System32\*.exe | Where-Object { $_.Status -ne 'Valid' }

# Check a specific file:
Get-AuthenticodeSignature C:\Windows\System32\calc.exe

Driver Signature Enforcement (DSE)

Windows normally blocks unsigned kernel drivers from loading. Attackers disable DSE via: test signing mode (bcdedit /set testsigning on), UEFI bootkit, or exploiting a vulnerable signed driver (BYOVD — Bring Your Own Vulnerable Driver). Check: bcdedit | findstr testsigning — should return "No".