Basis Technology Autopsy Ingestion Modules Configuration

Autopsy Ingestion Modules Configuration Guide

It is time for Autopsy Ingestion Modules configuration, after you finished the OptimizationCore Autopsy and Plugins installation Guide. Finally, when you finish configuration, you can continue to OptimizationCore Autopsy Usage Guide.

Affiliate: Experience limitless no-code automation, streamline your workflows, and effortlessly transfer data between apps with Make.com.

Hash Lookup Ingestion Module – Installing Hash sets

Autopsy will use Known Hash sets to check if the Data source that you are analyzing holds these hashes. Example: there are known files in Windows system folder, so there is no need to reanalyze them since they are already in the known hash set for Windows files. There can be hash set for known malware, so you will want to see if the files that you are analyzing contain some of the known malware hashes. Autopsy works with these formats:

Text - One hash starting each line (*.txt)
Index - NSRL - Generated by Autopsy / Sleuth Kit (*.idx)
SQLite hash sets created by Autopsy (*.kdb)
EnCase (*.hash)
HashKeeper (*.hsh)

Autopsy defers between “Known” files (potentially “good”, example: Windows system files) and “Notable” files (potentially “bad”, example: malware). More information is on the Autopsy Hash Lookup Module page.

We will be installing NIST NSLR hash set (more info can be found on their respective site). This is the first hash set that Autopsy recommends adding.

1. Download the latest NIST NSRL files for Autopsy. There will be three variations:

NSRL-###m-Autopsy.zip
NSRL-###-ios-Autopsy.zip
NSRL-###-Android-Autopsy.zip

From NSRL readme file:

For each quarterly release, there are three hash sets:
- 'm' or 'computer' contains hashes of known Windows / PC files
- Android contains hashes of known Android files
- ios contains hashes of known iOS files

2. Extract NSLR Hash sets and store somewhere that Autopsy is going to use them from.
3. Import each hash set as follows:

Tools => Options => [Hash Sets]
     [Import Hash Set]
        Hash Set Path: [Open]
        Destination: (*) Local
        *** Since we will be using local database
        Name: <You can leave the name as is, or choose any other>
        Type of hash set: (*) Known (NSLR or other)
        *** Since it is NSLR we already set it as "Known". If it would be any other type of hash set - you will need to choose if it is good hashes (known) or bad ones (Notable).
        [ ] Copy hash set into user configuration folder
        *** No need to copy since you copied it, or on the contrary you can check it if you want it to be in user directory files.

Known hashes will not appear in the right pane (“Tree => Views”) by default, but will appear in left pane (Data Sources area) under:

Results \ Keyword Hits \ Hashset Hits

You can change that behavior to show also in the right pane viewer:

[Tools] => [Options] => [View]
    "Global settings"
        Hide known files (i.e, those in the NIST NSRL) in the:
            [ ] Data Sources area (the directory hierarchy)
            [ ] Views area
    [OK]

After you import a hash set you need to [Index] it by clicking on the hash set. No need for the NSLR since it is IDX file with indexation applied.

Imported Hash sets will be available in the “Hash Lookup” ingestion module.

Interesting Files – Autopsy Ingestion Module Configuration

You can configure this module to scan for certain file set under a preset. Example: If you configure a list to search for “vmplayer.exe” (VMware Workstation Player) the result will be shown in the left pane.
Example to configure Interesting Files Rule Set for VMWare Player:

[Tools] => [Options] => [Interesting Files]
    [New Set]
        "Interesting Files Set Rule"
        Set Name: VMware Workstation Player
        Description: VMware Workstation Player main executable and VMDK extension files.
        [ ] Ignore Known Files
        *** Known files are the ones that appear in "Known" hash sets that you imported earlier. Meaning that if these will appear in one of the hash sets - the results from this rule will not be shown / analyzed.
        [OK]

You will return to [Interesting Files].
Creating Rule 1 for this Rule Set:

    Select the "Rule Set" that was just created
    On the right pane => [New Rule]
        Type: (*) Files
        [V] Name: vmplayer.exe
        (*) Full Name
        [OK]

Create Rule 2 for this Rule Set:

    On the right pane => [New Rule]
        Type: (*) Files
        [V] Name: vmdk
        (*) Extension Only
        [OK]

Keyword Search – Autopsy Ingestion Module Configuration

You can search for keywords in your Data source. “Known” words based on NSLR hash set will be ignored. If you want to can apply “Hash Lookup” ingestion module after the “Keywords Search” module.
Follow the steps to build keyword list:

[Tools] => [Options] => [Keyword Search]
    [Lists]
        [New List]
            New keyword list name: <Put the list name>
            [OK]

        On the right pane [New Keywords]
            Enter keywords (one per line) below: <Input the keywords of interest>
            Select type for keywords: (*) Exact Match
            *** You can also use Regex and Substrings
            [OK]

YARA Analyzer – Autopsy Ingestion Module Configuration

Initially the YARA Analyzer module comes without any rules. If you want to use it, you will need to add some in:

[Tools] => [Options] => [Yara Rule Sets]

File Type Identification – Ingestion Module

You can add MIME file types to Autopsy for the “File Type Identification” Ingestion Module:

[Tools] => [Options] => [File Types]

Autopsy Usage Guide

After you have finished configuring the Ingestion Modules – you can continue to OptimizationCore Autopsy Usage Guide.