[Osquery_manager] Shellbags artifact saved query

[tomsonpl]

Windows Shellbags Artifact

Windows Shellbags provide critical forensic evidence of user directory access patterns through Windows Explorer. This artifact tracks folder browsing history, including directories accessed via mapped network drives, USB devices, and local folders. Shellbags persist even after files or folders are deleted, making them invaluable for investigating user behavior, lateral movement, and data exfiltration activities.

Read https://p.elstc.co/paste/8mcHsmyg#Ab4Xl7T57kn-7xX9HdNGxhcjVojZGF4zD7Td9PxebNy

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	Windows Shellbags	✅	Windows	shellbags_windows_elastic	a4b2c8d0	Windows Shellbags forensic analysis for user activity investigation

Queries by Platform

---

🪟 Windows - Shellbags User Activity Analysis

Description

Collects Windows Shellbags data to identify directories accessed via Windows Explorer, providing visibility into user folder browsing patterns. This query extracts critical forensic artifacts including user SIDs, registry hive sources, directory paths, file system timestamps, and MFT references for comprehensive user activity investigation.

Result

Query results provide a chronologically ordered view of all directories accessed by users on the system. Each entry includes the user SID, registry source location, full path, three timestamps (modified, created, accessed), and MFT reference numbers. Results are sorted by most recent modification time, enabling rapid identification of current user activity and historical browsing patterns.

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

shellbags_windows_elastic

ECS Field Mappings

• user.id → sid
• registry.hive → source
• file.path → path
• file.mtime → modified_time
• file.created → created_time
• file.accessed → accessed_time

SQL Query

SELECT
  sid,
  source,
  path,
  modified_time,
  created_time,
  accessed_time,
  mft_entry,
  mft_sequence
FROM shellbags
WHERE path != '' AND path IS NOT NULL
ORDER BY modified_time DESC;

---

Forensic Context

Registry Locations Monitored:

• HKCU\Software\Microsoft\Windows\Shell\BagMRU
• HKCU\Software\Microsoft\Windows\Shell\Bags
• HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
• HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

This query provides essential Windows forensic capability for investigating user activity patterns, lateral movement, and data access behaviors through persistent shell artifacts.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b6543db