STIX

Overview

This document outlines the use of the STIX feature of Autopsy. This feature allows one or more Structured Threat Information Exchange (STIX) files to be run against a data source, reporting which indicators were found in the data source. More information about STIX can be found at https://stix.mitre.org/. This document assumes basic familiarity with Autopsy.

Quick Start

1. Create a case as normal and add a disk image (or folder of files) as a data source. To get the most out of the STIX module, ensure that the following ingest modules are selected:
   • Recent Activity
   • Hash Lookup (Check box to calculate MD5 hashes even with no database selected)
   • File Type Identification
   • Keyword Search (URL, IP, and Email addresses)
   • Email Parser
   • Extension Mismatch Detector
2. After the image has been added and ingest is complete, click the Report button then select STIX. Next choose either a single STIX file or a directory of STIX files to run against the image. It is possible to do this while ingest is running but the results will be incomplete.
3. Once the STIX report module is complete, there will be two sets of results:
   • Entries will be created under Interesting Items in the Autopsy tree, under a subheading for each indicator.
   • A log of which indicators/observables were found is generated by the report module (Follow the link on the Report Generation Progress window)

Supported CybOX Objects

• Address Object
  • Address_Value
• Domain Name Object
  • Value
• Email Message Object
  • To
  • CC
  • From
  • Subject
• File Object
  • Size_In_Bytes
  • File_Name
  • File_Path
  • File_Extension
  • Modified_Time
  • Accessed_Time
  • Created_Time
  • Hashes (MD5 only)
  • File_Format
  • is_masqueraded
• URI Object
  • Value
• URL History Object
  • Browser_Information (Name)
  • URL
  • Hostname
  • Referrer_URL
  • Page_Title
  • User_Profile_Name
• User Account Object
  • Home_Directory
  • Username
• Win Executable File Object
  • Time_Date_Stamp
• Windows Network Share Object
  • Local_Path
  • Netname
• Win Registry Key Object
  • Key (Required)
  • Hive
  • Values
• System Object
  • Hostname
  • Processor_Architecture
• Win System Object
  • Product_ID
  • Product_Name
  • Registered_Owner
  • Registered_Organization
  • Windows_System_Directory
  • Windows_Temp_Directory
• Win User Account Object
  • SID

See http://cybox.mitre.org for more information on CybOX Objects.

Limitations

• As shown in the list above, not all CybOX objects/fields are currently supported. When an unsupported object/field is found in an observable, its status is set to "indeterminate" instead of true or false. These indeterminate fields will not change the result of the observable composition (i.e., if the rest is true, the overall result will stay as true).
• Not all ConditionTypeEnum values are supported. It varies by field, but generally on String fields the following work: EQUALS, DOES_NOT_EQUAL, CONTAINS, DOES_NOT_CONTAIN, STARTS_WITH, ENDS_WITH. If a condition type is not supported there will be a warning in the log file.
• Related objects are not processed