create tsk_comment for malicious extension found

create tsk_comment for malicious extension found

RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java

@@ -107,7 +107,8 @@ class Chromium extends Extract {
     private static final String FAVICON_ARTIFACT_NAME = "TSK_FAVICON"; //NON-NLS
     private static final String LOCAL_STATE_ARTIFACT_NAME = "TSK_LOCAL_STATE"; //NON-NLS
     private static final String EXTENSIONS_ARTIFACT_NAME = "TSK_CHROME_EXTENSIONS"; //NON-NLS
-
+    private static final String MALICIOUS_EXTENSION_FOUND = "Malicious Extension Found - ";
+    
     private Boolean databaseEncrypted = false;
     private Boolean fieldEncrypted = false;
 
@@ -616,6 +617,11 @@ private void getExtensions(String browser, String browserLocation, String userNa
                 Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
                 bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_ID,
                         RecentActivityExtracterModuleFactory.getModuleName(), extension));
+                if (maliciousChromeExtensions.get(extension) != null) {
+                    bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT,
+                        RecentActivityExtracterModuleFactory.getModuleName(), 
+                        MALICIOUS_EXTENSION_FOUND + maliciousChromeExtensions.getOrDefault(extension, "No Source Identified")));
+                }
                 bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME,
                         RecentActivityExtracterModuleFactory.getModuleName(), extName));
                 bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DESCRIPTION,
@@ -637,26 +643,6 @@ private void getExtensions(String browser, String browserLocation, String userNa
                 } catch (TskCoreException ex) {
                     logger.log(Level.SEVERE, String.format("Failed to create Extension artifact for file (%d)", extensionFile.getId()), ex);
                 }
-                
-                 if (maliciousChromeExtensions.get(extension) != null & art != null) {
-                    bbattributes = new ArrayList<>();
-                    bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_ID,
-                        RecentActivityExtracterModuleFactory.getModuleName(), extension));
-                    bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT,
-                        RecentActivityExtracterModuleFactory.getModuleName(), 
-                        maliciousChromeExtensions.getOrDefault(extension, "No Source Identified")));
-                    try {
-                        bbartifacts.add(art.newAnalysisResult(
-                                BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_NOTABLE, 
-                                null, "Malicious Chrome Extensions", null, 
-                                bbattributes)
-                                .getAnalysisResult());
-                    } catch (TskCoreException ex) {
-                        logger.log(Level.SEVERE, String.format("Failed to create Extension artifact for file (%d)", extensionFile.getId()), ex);
-                    }
- 
-                 }
-
             }
 
             if (!context.dataSourceIngestIsCancelled()) {

RecentActivity/src/org/sleuthkit/autopsy/recentactivity/malicious_chrome_extensions.csv

@@ -334,5 +334,3 @@ flijfnhifgdcbhglkneplegafminjnhn,"https://www.mcafee.com/blogs/other-blogs/mcafe
 gbnahglfafmhaehbdmjedfhdmimjcbed,"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/malicious-cookie-stuffing-chrome-extensions-with-1-4-million-users"
 mmnbenehknklpbendgmgngeaignppnbe,"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/malicious-cookie-stuffing-chrome-extensions-with-1-4-million-users"
 pojgkmkfincpdkdgjepkmdekcahmckjp,"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/malicious-cookie-stuffing-chrome-extensions-with-1-4-million-users"
-dgiklkfkllikcanfonkcabmbdfmgleag,"Test Extension"
-fogppepbgmgkpdkinbojbibkhoffpief,"Test 2 Extension"
\ No newline at end of file