Signed Powershell Scripts not running

[Former Member]

Hi,

My code signed EXEs run without and issue, but my signed PS scripts get blocked.  Can someone please confirm whether MAC support signed PS scripts.

Cheers

Yostie 

[BenEllis]

What error message do you see in your s3diag or solidcore log when trying to run signed powershell.

Also can you give "sadmin ls -lax <path\powershell.ps1>" output

[Former Member]

Thanks for the quick reply Benjamin.  When running the signed powershell script, the event shown in Solicore is a Prevented File Execution.

I ran the "sadmin ls -lax <path\powershell.ps1>" output command on our signed PS script and the output is below.  It looks like MAC is unable to recognise the code signing cert within the PS script based on that output.  I also ran the same command on one of our signed EXEs, and it clearly identifies our cert.  Windows recognises our signed PS scripts as having a digital signature, when you right click on them and go to properties.

Output of sadmin ls may take some time as certificate extraction is in progress.
<?xml version="1.0" encoding="utf-8"?>
<solidifier xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="solidifier.xsd">
<list-solidified time="1557959204395" >
<file permission="rw-" file_type="script" checksum="8f4cb695e0298ba31abd9d0ac7c804188d570613" md5="6c12a179de9f4bed69dc23920c776eab" num_certificates="-1" file_size="0" file_version=" " file_original_name=" " file_company_name=" " file_product_name=" " file_product_version=" " application_name=" " product_guid=" " system_file="No" updater="No" file_mtime="0" cksum_auth="NA" auth_by_cert="No" allowed_by_elam="No" allow_by_name="No" ban_by_name="No" trusted_path="No" state="unso" execution_allowed="No" parent_process_name=" " parent_file_sha1_hash=" " parent_file_md5_hash=" " file_sha256_hash="3e04fdbcb98cc5e904b41e9870b104dce300475ea7f0e69c7a7dff6d9e647098" parent_workflow_id=" " inv_add_time="0" file_info_attr="0" reserved_1=" " file_base_name="Signed.ps1" path="C:\Users\User\Documents\Signed.ps1" >
</file>
<certs-list>
</certs-list>
</list-solidified>
</solidifier>

[neiltaph]

Any news on this? 

We are experiencing the same issue? It seems it can not see the certificate from PowerShell files. 

If it cant do it, that is fine, just need to know.

[Former Member]

Unfortunately solidcore does not support signature whitelisting for powershell files.  You will need to whitelist via another means (i.e hash, name, path, etc)

[neiltaph]

Thanks for the quick response. All good. Its nice to know.