saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/analyzing-windows-shellbag-artifacts/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.1 KiB
Raw Blame History

API Reference: Windows ShellBag Forensics

SBECmd (Eric Zimmerman)

Syntax

SBECmd.exe -d <registry_dir>              # Process directory of hives
SBECmd.exe --hive <NTUSER.DAT>            # Single hive
SBECmd.exe -d <dir> --csv <output_dir>    # CSV export
SBECmd.exe -d <dir> -l                    # Live system registry

Output Fields

Field Description
AbsolutePath Full reconstructed folder path
CreatedOn Folder creation timestamp
ModifiedOn Folder modification timestamp
AccessedOn Folder access timestamp
MFTEntryNumber NTFS MFT reference
ShellType Folder, network, zip, etc.

ShellBags Explorer (GUI)

Features

  • Tree view of folder access history
  • Timeline view of access patterns
  • Filtering by date range
  • Export to CSV/JSON

Registry Paths

NTUSER.DAT

Software\Microsoft\Windows\Shell\BagMRU
Software\Microsoft\Windows\Shell\Bags
Software\Microsoft\Windows\ShellNoRoam\BagMRU

UsrClass.dat

Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Local Settings\Software\Microsoft\Windows\Shell\Bags

regipy (Python)

Installation

pip install regipy

Usage

from regipy.registry import RegistryHive

hive = RegistryHive("NTUSER.DAT")
key = hive.get_key("Software\Microsoft\Windows\Shell\BagMRU")
for value in key.iter_values():
    print(value.name, type(value.value))

Shell Item Types

Type Byte Description
0x1F Root folder (GUID - Desktop, My Computer)
0x2F Volume (drive letter)
0x31 File entry (directory)
0x32 File entry (file)
0x41 Network location
0x42 Compressed folder
0x46 Network share (UNC path)
0x71 Control Panel item

Forensic Value

Artifact Intelligence
Network paths Remote share access (lateral movement)
USB paths Removable media (data exfiltration)
Deleted folders Evidence of anti-forensics awareness
Temp directories Staging areas for tools/malware
AppData paths Persistence mechanism locations
Recycle Bin Awareness of deleted content