New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Windows Shellbag Analysis

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Reconstructs folder browsing history from Windows Shellbag registry data using SBECmd and Shellbags Explorer, even for folders that were later deleted.

Apache-2.0Auto-check passedSecurity

Install Windows Shellbag Analysis

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-windows-shellbag-artifacts --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyzing-windows-shellbag-artifacts .claude/skills/analyzing-windows-shellbag-artifacts && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
analyzing-windows-shellbag-artifacts
GitHub stars
34k
Token cost
~2.3k tokens
SKILL.md length
398 words
Files
8 (incl. scripts, references, assets)
Skills in repo
637
Repo updated
First seen
Licence
Apache-2.0

At a glance

Reconstructs folder browsing history from Windows Shellbag registry data using SBECmd and Shellbags Explorer, even for folders that were later deleted.

  • Proving a user opened a folder that has since been deleted
  • SKILL.md covers Overview, When to Use, Prerequisites and Registry Locations, plus 5 more sections
  • Runs Python scripts from its folder
  • Reconstructing folder browsing on USB drives or network shares

What it does

Shellbags record how users interact with folders in Explorer, including view settings, and they persist after a folder is deleted or a drive is disconnected. The skill explains where the data lives: BagMRU and Bags keys inside `NTUSER.DAT` and `UsrClass.dat`, with BagMRU holding a numbered tree of Shell Items that encode type, short and long names, timestamps and NTFS MFT references.

Analysis uses the EZ Tools command-line SBECmd and Shellbags Explorer to reconstruct folder access history, including removable media and network shares, for digital forensics and incident response work. Helper scripts (`scripts/agent.py`, `scripts/process.py`), a report template and reference files on workflows, standards and an API come with it. Listed prerequisites are familiarity with forensics concepts, a lab environment, Python 3.8 or newer, and proper authorization for any testing.

When your agent uses it

  • Proving a user opened a folder that has since been deleted
  • Reconstructing folder browsing on USB drives or network shares
  • Building a timeline of Explorer folder access during a DFIR case

Example prompts

  • “Parse the NTUSER.DAT from this evidence image and list the folders the user browsed.”
  • “Show whether this user ever opened folders on the removable drive, using Shellbags.”
  • “Write up the shellbag findings with the report template.”

Requirements

  • SBECmd and Shellbags Explorer (EZ Tools)
  • Python 3.8 or newer
  • Authorization to examine the system, ideally in a lab environment

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • cybertriage.com
    • sans.org
    • magnetforensics.com
    • ericzimmerman.github.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Windows Shellbag Analysis loads about 2.3k tokens when it runs, and up to ~3.1k if it reads all its reference files. Until then it costs about 102 tokens; SKILL.md has 398 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~102
When it runs · the whole SKILL.md, loaded when a task matches
~2.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 398 words, ~2,291 tokens.

Download SKILL.mdSave it as .claude/skills/analyzing-windows-shellbag-artifacts/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
analyzing-windows-shellbag-artifacts
description
Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even after the folders are deleted. Use when reconstructing a user's folder access history or proving access to a since-removed directory in DFIR work.
domain
cybersecurity
subdomain
digital-forensics
tags
shellbags, windows-registry, sbecmd, shellbags-explorer, folder-access, user-activity, removable-media, network-shares, bagmru, dfir
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
RS.AN-03, DE.AE-02, RS.MA-01
mitre_attack
T1083, T1074.001, T1135, T1025, T1070.004

Analyzing Windows Shellbag Artifacts

Overview

Shellbags are Windows registry artifacts that track how users interact with folders through Windows Explorer, storing view settings such as icon size, window position, sort order, and view mode. From a forensic perspective, Shellbags provide definitive evidence of folder access -- even folders that no longer exist on the system. When a user browses to a folder via Windows Explorer, the Open/Save dialog, or the Control Panel, a Shellbag entry is created or updated in the user's registry hive. These entries persist after folder deletion, drive disconnection, and even across user profile resets, making them invaluable for proving that a user navigated to specific directories on local drives, USB devices, network shares, or zip archives.

When to Use

  • When investigating security incidents that require analyzing windows shellbag artifacts
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with digital forensics concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Registry Locations

Windows 7/8/10/11
HiveKey PathStores
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagMRUFolder hierarchy tree
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagsView settings per folder
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagMRUDesktop/Explorer shell
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagsAdditional view settings
Show full SKILL.md (176 more words)Show less
BagMRU Structure

The BagMRU key contains a hierarchical tree of numbered subkeys representing the directory structure. Each subkey value contains a Shell Item (SHITEMID) binary blob encoding the folder identity:

  • Root (BagMRU): Desktop namespace root
  • BagMRU\0: Typically "My Computer"
  • BagMRU\0\0: First drive (e.g., C:)
  • BagMRU\0\0\0: First subfolder on C:

Each Shell Item contains:

  • Item type (folder, drive, network, zip, control panel)
  • Short name (8.3 format)
  • Long name (Unicode)
  • Creation/modification timestamps
  • MFT entry/sequence for NTFS folders

Analysis with EZ Tools

SBECmd (Command Line)
powershell
# Parse shellbags from a directory of registry hives
SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv

# Parse from a live system (requires admin)
SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csv

# Key output columns:
# AbsolutePath - Full reconstructed path
# CreatedOn - When the folder was first browsed
# ModifiedOn - When view settings were last changed
# AccessedOn - Last access timestamp
# ShellType - Type of shell item (Directory, Drive, Network, etc.)
# Value - Raw shell item data
ShellBags Explorer (GUI)
powershell
# Launch GUI tool for interactive analysis
ShellBagsExplorer.exe

# Load registry hives: File > Load Hive
# Navigate the tree structure to see folder hierarchy
# Right-click entries for detailed shell item properties

Forensic Investigation Scenarios

Proving USB Device Browsing
text
Shellbag Path: My Computer\E:\Confidential\Project_Files
ShellType: Directory (on removable volume)
CreatedOn: 2025-03-15 09:30:00 UTC

This proves the user navigated to E:\Confidential\Project_Files
via Windows Explorer, even if the USB drive is no longer connected.
The volume letter E: and directory timestamps can be correlated
with USBSTOR and MountPoints2 registry entries.
Detecting Network Share Access
text
Shellbag Path: \\FileServer01\Finance\Q4_Reports
ShellType: Network Location
AccessedOn: 2025-02-20 14:15:00 UTC

This proves the user browsed to a network share, even if
the share has been decommissioned or access revoked.
Identifying Deleted Folder Knowledge
text
Shellbag Path: C:\Users\suspect\Documents\Exfiltration_Staging
ShellType: Directory
CreatedOn: 2025-01-10 08:00:00 UTC

Even though C:\Users\suspect\Documents\Exfiltration_Staging
no longer exists, the Shellbag entry proves the user
created and navigated to this folder.

Limitations

  • Shellbags only record folder-level interactions, not individual file access
  • Only created through Windows Explorer shell and Open/Save dialogs
  • Command-line access (cmd, PowerShell) does not generate Shellbag entries
  • Programmatic file access via APIs does not generate Shellbag entries
  • Timestamps may reflect view setting changes, not necessarily folder access
  • Windows may batch-update Shellbag entries during Explorer shutdown

References

Example Output

text
$ SBECmd.exe -d "C:\Evidence\Users\jsmith" --csv /analysis/shellbag_output

SBECmd v2.1.0 - ShellBags Explorer (Command Line)
====================================================
Processing hives for user: jsmith
  NTUSER.DAT:  C:\Evidence\Users\jsmith\NTUSER.DAT
  UsrClass.dat: C:\Evidence\Users\jsmith\AppData\Local\Microsoft\Windows\UsrClass.dat

[+] NTUSER.DAT shellbag entries:   456
[+] UsrClass.dat shellbag entries: 1,234
[+] Total shellbag entries:        1,690

--- Folder Access Timeline (Incident Window) ---
Last Accessed (UTC)     | Folder Path                                             | Type        | Access Count
------------------------|---------------------------------------------------------|-------------|-------------
2024-01-15 14:34:05     | C:\Users\jsmith\Downloads                               | File System | 45
2024-01-15 14:36:25     | C:\ProgramData\Updates                                  | File System | 3
2024-01-15 15:05:00     | \\FILESERV01\Finance                                    | Network     | 2
2024-01-15 15:12:30     | \\FILESERV01\Finance\Q4_Reports                          | Network     | 1
2024-01-15 15:30:00     | E:\                                                     | Removable   | 4
2024-01-15 15:30:45     | E:\Backup                                               | Removable   | 3
2024-01-15 15:31:20     | E:\Backup\Corporate_Data                                | Removable   | 2
2024-01-15 16:12:45     | \\FILESERV01\HR\Employees                                | Network     | 1
2024-01-15 16:15:00     | \\FILESERV01\HR\Employees\Records_2024                   | Network     | 1
2024-01-16 02:35:00     | C:\Windows\Temp                                         | File System | 5
2024-01-17 02:44:00     | C:\ProgramData\svc                                     | File System | 2
2024-01-18 01:10:00     | C:\Users\jsmith\AppData\Local\Temp                      | File System | 8

--- Network Share Access ---
  \\FILESERV01\Finance             First: 2023-09-10  Last: 2024-01-15
  \\FILESERV01\Finance\Q4_Reports  First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\FILESERV01\HR\Employees        First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\DC01\SYSVOL                    First: 2023-03-15  Last: 2024-01-16  (anomalous access time)

--- Removable Device Access ---
  E:\ (USB Drive)
    Volume Name:    BACKUP_DRIVE
    First Accessed: 2024-01-15 15:30:00 UTC
    Last Accessed:  2024-01-15 15:45:22 UTC
    Folders Browsed: 3 (E:\, E:\Backup, E:\Backup\Corporate_Data)

--- Deleted/No Longer Existing Paths ---
  C:\ProgramData\Updates\                (folder deleted, shellbag persists)
  C:\ProgramData\svc\                    (folder deleted, shellbag persists)
  C:\Windows\Temp\tools\                 (folder deleted, shellbag persists)

Summary:
  Total unique folders accessed:  1,690
  Network shares accessed:        4 (2 newly accessed during incident)
  Removable media:                1 USB device (data staging suspected)
  Deleted folder evidence:        3 paths (anti-forensics indicator)
  CSV exported to:                /analysis/shellbag_output/

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/analyzing-windows-shellbag-artifacts of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Windows Shellbag Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Windows Shellbag Analysis compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Windows Shellbag Analysis this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.3kAutomated safety check: PassApache-2.0
Auditing Python Dependenciesjeremylongshore/tons-of-skills-marketplace2.8k—~2.3kAutomated safety check: NotesMIT
Re Mobile Forensicsdslsdzc/rev-skills125—~1.6kAutomated safety check: PassApache-2.0
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
CodeQL Security Scantrailofbits/skills7.4k—~4.6kAutomated safety check: NotesCC-BY-SA-4.0
Kedro Security Reviewkedro-org/kedro11k—~3.3kAutomated safety check: PassCustom licence

Similar skills

  • Auditing Python Dependencies

    jeremylongshore/tons-of-skills-marketplace

    Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema.

    2.8k GitHub stars~2.3k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Re Mobile Forensics

    dslsdzc/rev-skills

    移动设备取证：Android/iOS 备份解析、应用数据提取、删除恢复与时间线. An agent skill from dslsdzc/rev-skills.

    125 GitHub stars~1.6k tokensUpdated 3 days ago
    MobileAuto-check passed

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated yesterday
    SecurityAuto-check: notes

  • CodeQL Security Scan

    trailofbits/skills

    Official

    Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

    7.4k GitHub stars~4.6k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Kedro Security Review

    kedro-org/kedro

    Run a Kedro security scan on the full codebase or just a pull request.

    11k GitHub stars~3.3k tokensUpdated yesterday
    SecurityAuto-check passed

  • Vulners API Python SDK

    vulnersCom/api

    A skill your agent uses when modifying, testing, documenting, or reviewing the Vulners Python SDK.

    375 GitHub stars~2.3k tokensUpdated 10 days ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 637 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Windows Shellbag Analysis

What does Windows Shellbag Analysis do?

Reconstructs folder browsing history from Windows Shellbag registry data using SBECmd and Shellbags Explorer, even for folders that were later deleted. Shellbags record how users interact with folders in Explorer, including view settings, and they persist after a folder is deleted or a drive is disconnected.dat`, with BagMRU holding a numbered tree of Shell Items that encode type, short and long names, timestamps and NTFS MFT references.

When should I use Windows Shellbag Analysis?

Windows Shellbag Analysis fits situations like: proving a user opened a folder that has since been deleted; reconstructing folder browsing on USB drives or network shares; building a timeline of Explorer folder access during a DFIR case.

How do I install Windows Shellbag Analysis in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts -a claude-code`. Or copy the skill folder (skills/analyzing-windows-shellbag-artifacts in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/analyzing-windows-shellbag-artifacts in your project. Claude Code loads it when a task matches its description.

How do I install Windows Shellbag Analysis in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts -a codex`. Or copy the skill folder (skills/analyzing-windows-shellbag-artifacts in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/analyzing-windows-shellbag-artifacts in your project. Codex loads it when a task matches its description.

Can I use Windows Shellbag Analysis in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyzing-windows-shellbag-artifacts, .gemini/skills/analyzing-windows-shellbag-artifacts, .github/skills/analyzing-windows-shellbag-artifacts and .opencode/skills/analyzing-windows-shellbag-artifacts in your project.

What does Windows Shellbag Analysis need to run?

Going by SKILL.md and its folder, Windows Shellbag Analysis needs Python for the scripts in its folder. Our summary lists: SBECmd and Shellbags Explorer (EZ Tools); Python 3.8 or newer; Authorization to examine the system, ideally in a lab environment.

Does Windows Shellbag Analysis access the network?

SKILL.md names 4 domains. As links in the text: cybertriage.com, sans.org, magnetforensics.com and ericzimmerman.github.io. This is read from the text; nothing was executed.

Is Windows Shellbag Analysis safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Windows Shellbag Analysis use?

Windows Shellbag Analysis is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Windows Shellbag Analysis use?

About 2.3k tokens (SKILL.md is roughly 9.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 780 tokens, read only when the agent opens those files.

What are the alternatives to Windows Shellbag Analysis?

Skills that share tags, products or a category with Windows Shellbag Analysis: Auditing Python Dependencies (jeremylongshore/tons-of-skills-marketplace, 2.8k stars), Re Mobile Forensics (dslsdzc/rev-skills, 125 stars), Security Auditor (eigent-ai/eigent, 15k stars) and CodeQL Security Scan (trailofbits/skills, 7.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Windows Shellbag Analysis?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,922 GitHub stars. The repository holds 637 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.