domains / families / security / analyzing-windows-shellbag-artifacts

analyzing-windows-shellbag-artifacts

separate

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

When to use

• When investigating security incidents that require analyzing windows shellbag artifacts
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

When not to use

• Shellbags only record folder-level interactions, not individual file access
• Only created through Windows Explorer shell and Open/Save dialogs
• Command-line access (cmd, PowerShell) does not generate Shellbag entries
• Programmatic file access via APIs does not generate Shellbag entries
• Timestamps may reflect view setting changes, not necessarily folder access
• Windows may batch-update Shellbag entries during Explorer shutdown

Skill page

Source