PowerShell Script Security Auditing

When you digitally sign scripts, you can easily tell whether a script was manipulated or comes from an untrusted source. Here is a function that can find all PowerShell scripts on a drive or in a folder and lists security issues:

function Test-PSScript($Path='C:\', [switch]$UnsafeOnly) {
  Get-ChildItem $Path -Filter *.ps1 -Recurse -ea 0 |
  Get-AuthenticodeSignature | 
  Where-Object { ($_.Status -ne 'Valid') -or ($UnsafeOnly -eq $false) } |
  ForEach-Object {
    $result = $_ | Select-Object Path, Status
    switch($_.Status) {
      'notsigned' { $result.Status = 'no digital signature present, unsafe script.' }
      'unknownerror' { $result.Status = 'script author is not trusted by your organization.' }
      'hashmismatch' { $result.Status = 'script content has been manipulated.' }
      'valid' { $result.Status = 'trusted script in original condition.' }
    }
    $result
  }
}

Test-PSScript c:\ | Format-List

ReTweet this Tip!