sigverif.exe

File Signature Verification file version info (xCyclopedia)

LOLBAS Execute 1 ATT&CK technique 1 documented command 6 known copies with hashes

How sigverif.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for sigverif.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Launch sigverif.exe GUI, click 'Advanced', specify arbitrary executable path as 'log file name', then click 'View Log' to execute the binary.

sigverif.exe

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for sigverif.exe, by Moshe Kaplan, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for sigverif.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218System Binary Proxy Execution

Is it the real sigverif.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionFile Signature Verification

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sigverif.exe · signed by Microsoft Windows

71c7fc25c8769edd10452e2c4574b2e4b1822f0e7b605b6c2b5d8219fc591d18

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sigverif.exe · signed by Microsoft Windows

064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sigverif.exe · signed by Microsoft Windows

943c93039215a85645dc4fa894468e261c997f0f1eeca043d6b5dc10c47108d0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sigverif.exe · signed by Microsoft Windows

776501b9c220b910503be488126970e5d5159afa543706b528b8a0737184ef9e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sigverif.exe · signed by Microsoft Windows

6008ae0fe2a26bf8a92597a133b1b970d324c79b7f3c53f74567c4d087e76b3d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sigverif.exe · not signed

16fe4b3d2c4cde39c0ea555581d8dfb929899c3d650685daa21eff59ae4e8fde

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.