Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Windows Shellbag Artifacts · mukul975 | DecimalAI

Analyzing Windows Shellbag Artifacts

SkillScore17Maintained

analyzing-windows-shellbag-artifacts

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-windows-shellbag-artifacts/SKILL.md

decimalai skills pull analyzing-windows-shellbag-artifacts --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-windows-shellbag-artifacts/SKILL.md https://app.decimal.ai/s/analyzing-windows-shellbag-artifacts/SKILL.md

Raw file: /s/analyzing-windows-shellbag-artifacts/SKILL.md ↗ · machine-readable summary at /s/analyzing-windows-shellbag-artifacts.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +17% lift · at higher cost+121% tokens0% turns17% of whole cases pass with skill (4/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-07	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-09	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-17	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-windows-shellbag-artifacts/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Analyzing Windows Shellbag Artifacts

Overview

Shellbags are Windows registry artifacts that track how users interact with folders through Windows Explorer, storing view settings such as icon size, window position, sort order, and view mode. From a forensic perspective, Shellbags provide definitive evidence of folder access -- even folders that no longer exist on the system. When a user browses to a folder via Windows Explorer, the Open/Save dialog, or the Control Panel, a Shellbag entry is created or updated in the user's registry hive. These entries persist after folder deletion, drive disconnection, and even across user profile resets, making them invaluable for proving that a user navigated to specific directories on local drives, USB devices, network shares, or zip archives.

When to Use

When investigating security incidents that require analyzing windows shellbag artifacts
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with digital forensics concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Registry Locations

Windows 7/8/10/11

| Hive | Key Path | Stores | |------|---------|--------| | NTUSER.DAT | Software\Microsoft\Windows\Shell\BagMRU | Folder hierarchy tree | | NTUSER.DAT | Software\Microsoft\Windows\Shell\Bags | View settings per folder | | UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\BagMRU | Desktop/Explorer shell | | UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\Bags | Additional view settings |

BagMRU Structure

The BagMRU key contains a hierarchical tree of numbered subkeys representing the directory structure. Each subkey value contains a Shell Item (SHITEMID) binary blob encoding the folder identity:

Root (BagMRU): Desktop namespace root
BagMRU\0: Typically "My Computer"
BagMRU\0\0: First drive (e.g., C:)
BagMRU\0\0\0: First subfolder on C:

Each Shell Item contains:

Item type (folder, drive, network, zip, control panel)
Short name (8.3 format)
Long name (Unicode)
Creation/modification timestamps
MFT entry/sequence for NTFS folders

Analysis with EZ Tools

SBECmd (Command Line)

powershell
# Parse shellbags from a directory of registry hives
SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv

# Parse from a live system (requires admin)
SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csv

# Key output columns:
# AbsolutePath - Full reconstructed path
# CreatedOn - When the folder was first browsed
# ModifiedOn - When view settings were last changed
# AccessedOn - Last access timestamp
# ShellType - Type of shell item (Directory, Drive, Network, etc.)
# Value - Raw shell item data

ShellBags Explorer (GUI)

powershell
# Launch GUI tool for interactive analysis
ShellBagsExplorer.exe

# Load registry hives: File > Load Hive
# Navigate the tree structure to see folder hierarchy
# Right-click entries for detailed shell item properties

Forensic Investigation Scenarios

Proving USB Device Browsing

text
Shellbag Path: My Computer\E:\Confidential\Project_Files
ShellType: Directory (on removable volume)
CreatedOn: 2025-03-15 09:30:00 UTC

This proves the user navigated to E:\Confidential\Project_Files
via Windows Explorer, even if the USB drive is no longer connected.
The volume letter E: and directory timestamps can be correlated
with USBSTOR and MountPoints2 registry entries.

Detecting Network Share Access

text
Shellbag Path: \\FileServer01\Finance\Q4_Reports
ShellType: Network Location
AccessedOn: 2025-02-20 14:15:00 UTC

This proves the user browsed to a network share, even if
the share has been decommissioned or access revoked.

Identifying Deleted Folder Knowledge

text
Shellbag Path: C:\Users\suspect\Documents\Exfiltration_Staging
ShellType: Directory
CreatedOn: 2025-01-10 08:00:00 UTC

Even though C:\Users\suspect\Documents\Exfiltration_Staging
no longer exists, the Shellbag entry proves the user
created and navigated to this folder.

Limitations

Shellbags only record folder-level interactions, not individual file access
Only created through Windows Explorer shell and Open/Save dialogs
Command-line access (cmd, PowerShell) does not generate Shellbag entries
Programmatic file access via APIs does not generate Shellbag entries
Timestamps may reflect view setting changes, not necessarily folder access
Windows may batch-update Shellbag entries during Explorer shutdown

References

Shellbags Forensic Analysis 2025: https://www.cybertriage.com/blog/shellbags-forensic-analysis-2025/
SANS Shellbag Forensics: https://www.sans.org/blog/computer-forensic-artifacts-windows-7-shellbags
Magnet Forensics Shellbag Analysis: https://www.magnetforensics.com/blog/forensic-analysis-of-windows-shellbags/
ShellBags Explorer: https://ericzimmerman.github.io/

Example Output

text
$ SBECmd.exe -d "C:\Evidence\Users\jsmith" --csv /analysis/shellbag_output

SBECmd v2.1.0 - ShellBags Explorer (Command Line)
====================================================
Processing hives for user: jsmith
  NTUSER.DAT:  C:\Evidence\Users\jsmith\NTUSER.DAT
  UsrClass.dat: C:\Evidence\Users\jsmith\AppData\Local\Microsoft\Windows\UsrClass.dat

[+] NTUSER.DAT shellbag entries:   456
[+] UsrClass.dat shellbag entries: 1,234
[+] Total shellbag entries:        1,690

--- Folder Access Timeline (Incident Window) ---
Last Accessed (UTC)     | Folder Path                                             | Type        | Access Count
------------------------|---------------------------------------------------------|-------------|-------------
2024-01-15 14:34:05     | C:\Users\jsmith\Downloads                               | File System | 45
2024-01-15 14:36:25     | C:\ProgramData\Updates                                  | File System | 3
2024-01-15 15:05:00     | \\FILESERV01\Finance                                    | Network     | 2
2024-01-15 15:12:30     | \\FILESERV01\Finance\Q4_Reports                          | Network     | 1
2024-01-15 15:30:00     | E:\                                                     | Removable   | 4
2024-01-15 15:30:45     | E:\Backup                                               | Removable   | 3
2024-01-15 15:31:20     | E:\Backup\Corporate_Data                                | Removable   | 2
2024-01-15 16:12:45     | \\FILESERV01\HR\Employees                                | Network     | 1
2024-01-15 16:15:00     | \\FILESERV01\HR\Employees\Records_2024                   | Network     | 1
2024-01-16 02:35:00     | C:\Windows\Temp                                         | File System | 5
2024-01-17 02:44:00     | C:\ProgramData\svc                                     | File System | 2
2024-01-18 01:10:00     | C:\Users\jsmith\AppData\Local\Temp                      | File System | 8

--- Network Share Access ---
  \\FILESERV01\Finance             First: 2023-09-10  Last: 2024-01-15
  \\FILESERV01\Finance\Q4_Reports  First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\FILESERV01\HR\Employees        First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\DC01\SYSVOL                    First: 2023-03-15  Last: 2024-01-16  (anomalous access time)

--- Removable Device Access ---
  E:\ (USB Drive)
    Volume Name:    BACKUP_DRIVE
    First Accessed: 2024-01-15 15:30:00 UTC
    Last Accessed:  2024-01-15 15:45:22 UTC
    Folders Browsed: 3 (E:\, E:\Backup, E:\Backup\Corporate_Data)

--- Deleted/No Longer Existing Paths ---
  C:\ProgramData\Updates\                (folder deleted, shellbag persists)
  C:\ProgramData\svc\                    (folder deleted, shellbag persists)
  C:\Windows\Temp\tools\                 (folder deleted, shellbag persists)

Summary:
  Total unique folders accessed:  1,690
  Network shares accessed:        4 (2 newly accessed during incident)
  Removable media:                1 USB device (data staging suspected)
  Deleted folder evidence:        3 paths (anti-forensics indicator)
  CSV exported to:                /analysis/shellbag_output/

Illustrative Want to see what analyzing-windows-shellbag-artifacts would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/27/2026, 23:56 UTC · 23 cases

Lift

+17%

17% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+121%

3,363.52 vs 1,519.17

fail → pass · 4fail → fail · 19

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-17 An analyst identifies a Shellbag entry pointing to drive letter E:\Staging. To correlate this drive letter with the specific physical USB hardware device serial number and volume details, which additional Windows registry keys should be examined alongside Shellbags?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When automating Shellbag extraction across multiple disk images using command-line EZ Tools, an engineer wants to output the results as CSV into directory C:\ForensicOutput with the explicit output filename incident_bags.csv. The engineer attempts using standard stdout redirection with '>'. Which command flags should be passed to direct the tool to write CSV output to a target directory and custom file name?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When conducting timeline analysis, an investigator notes that a Shellbag timestamp for folder access does not match the exact second a user opened a folder in Explorer. Why might Shellbag registry updates exhibit a delay relative to exact folder click times?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When analyzing user view settings such as icon arrangement and window position for folders in NTUSER.DAT, a junior analyst looks inside NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU. Under which key path within NTUSER.DAT are per-folder view settings stored?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 An analyst requires a graphical user interface tool from EZ Tools to interactively open offline registry hives, render the reconstructed folder hierarchy in a visual tree, and inspect shell item properties. Which tool should be launched?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 During an active incident triage on a live Windows machine, an incident responder needs to run a command-line tool from EZ Tools to extract and parse live shellbag registry entries without requiring manual raw hive exporting or unhooking locked files. What tool and command-line option should be used to parse from the live system?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 In Windows 10 forensic investigations, an analyst needs to locate the BagMRU folder hierarchy key corresponding to the Desktop and Windows Explorer shell. The analyst suspects this key is inside NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU. Which registry hive file and key path actually store the Desktop/Explorer shell BagMRU tree?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 During a workstation investigation, an analyst wants to determine how many times an executable file like cmd.exe or vssadmin.exe was launched by a specific user via the graphical user interface and find its last execution timestamp. Should the analyst inspect Windows Shellbags registry keys to gather this binary execution frequency evidence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 To analyze Shellbag artifacts for a user named jsmith, an investigator needs to pull UsrClass.dat. A tier-1 analyst looks directly in C:\Users\jsmith\UsrClass.dat. What is the correct relative file path for UsrClass.dat under a user's profile folder?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An insider browsed to \\FileServer01\Finance\Restricted via Windows Explorer. Later, access to the share was revoked and the network share was unmapped. Will Shellbag analysis reveal the UNC path of the network share accessed by the user?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 In Windows registry Shellbag analysis, the BagMRU key constructs a tree of subkeys. If an analyst observes the path BagMRU\0\0, what structure does BagMRU\0 represent and what does BagMRU\0\0 represent in the hierarchy?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-23 When running SBECmd from the command line to process an offline folder containing user registry hives (NTUSER.DAT and UsrClass.dat), an investigator tries using -f to point to the directory C:\Evidence\Registry. Which command-line argument specifies the input directory of hives for SBECmd?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 A forensic investigator needs to prove that a suspect opened a specific file named Contracts.docx located inside C:\Users\suspect\Documents\ProjectX\. Does parsing the Shellbags registry artifact provide direct proof of individual file opens inside a folder?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 What top-level registry key name serves as the Desktop namespace root in the Shellbag folder hierarchy within user registry hives?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 An intruder accessed a compromised endpoint and executed the command 'type C:\Confidential\Financials.pdf' inside a PowerShell console window to read confidential data. Will this directory traversal and file inspection in PowerShell generate a new Shellbag entry under BagMRU?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 To determine if a malicious binary payload.exe was previously executed on a system across reboots, an analyst is deciding whether to parse Shellbags or inspect Application Compatibility Cache (Shimcache). Which artifact is responsible for tracking executable execution file metadata for app compatibility?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Each value in a BagMRU subkey contains a binary Shell Item (SHITEMID) blob. An analyst believes this binary data contains network socket IPs and file hashes. What actual structural file system metadata fields are stored inside a Shell Item binary blob?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 An attacker creates a folder C:\Temp\ExfilStaging, copies sensitive documents into it, browses the folder using Windows Explorer, and then permanently deletes C:\Temp\ExfilStaging from disk. If an analyst parses the target's NTUSER.DAT and UsrClass.dat hives post-deletion, what evidence regarding C:\Temp\ExfilStaging will remain in Shellbags?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 A USB thumb drive labeled E: was inserted into an endpoint and browsed via Windows Explorer, but the user unplugged the drive before incident response imaged the machine. The analyst needs to determine if folder browsing on removable volume E: can still be identified from registry artifacts. Does Shellbags retain evidence of browsed paths on disconnected USB drives?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 In parsed Shellbag reports, entries contain CreatedOn, ModifiedOn, and AccessedOn timestamps. A forensic examiner assumes ModifiedOn indicates the exact time a user edited or created a text file inside that directory. What action actually updates the ModifiedOn timestamp of a Shellbag entry?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 A user opens Notepad, clicks File > Open, and navigates through C:\Secret\Files\ using the standard Windows file picker dialog to select a document. Will this action generate or update Shellbag artifacts, or do Shellbags only form when opening full Windows Explorer windows?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 In parsed Shellbag CSV output generated by command-line tools, which specific column header identifies whether a folder entry represents a local Directory, Drive, Network Location, or Zip archive?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 When examining CSV output from Shellbag parsing tools, an investigator wants to filter by the full reconstructed directory path. Which specific column header holds the complete folder path?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +17 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 17.4%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/27/2026, 23:56 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run17

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Analyzing Windows Shellbag Artifacts

SkillSafety

Source

Analyzing Windows Shellbag Artifacts

Overview

When to Use

Prerequisites

Registry Locations

Windows 7/8/10/11

BagMRU Structure

Analysis with EZ Tools

SBECmd (Command Line)

ShellBags Explorer (GUI)

Forensic Investigation Scenarios

Proving USB Device Browsing

Detecting Network Share Access

Identifying Deleted Folder Knowledge

Limitations

References

Example Output

How this skill was measured

Related skills