TL;DR Introduction Shellbags are a valuable forensic artifact, providing analysts with information about user interactions ...

Closing the gaps is not enough against the current toolshell attacks. After all, attackers could already be inside. We show ...