Overview
The CertificateThumbprints command enumerates thumbprints (SHA-1 hashes) for all certificates in all certificate stores on the system. Thumbprints uniquely identify certificates and are often used in configuration files, security policies, and for certificate pinning.Syntax
This command does not support remote execution.
Output
The command returns:- Certificate store location (CurrentUser/LocalMachine)
- Store name (My, Root, CA, TrustedPublisher, etc.)
- Certificate subject
- Thumbprint (SHA-1 hash)
Use Cases
- Red Team
- Blue Team
- Identify trusted root certificates
- Find certificate pinning configurations
- Discover custom trusted CAs
- Locate certificates used in applications
- Identify potential trust anchor manipulation
Example Output
Remote Execution
Detection Considerations
Minimal detection surface - standard certificate store enumeration.
Related Commands
- Certificates - Detailed certificate information
- AMSIProviders - AMSI provider enumeration
- AntiVirus - Security product enumeration