The Rootkit Exorcist: Summoning Local AI to Investigate Suspicious Scripts 👻

Description and use

The Rootkit Exorcist scans scripts for suspicious command patterns, maps findings to MITRE ATT&CK, and uses a locally running Llama 3.2 1B via Ollama to generate AI‑assisted investigation notes in SOC or Exorcist modes, with automated tests passing.

Problem

Detect and interpret suspicious command patterns in scripts without executing them, while providing human‑readable investigation notes.

Outcome

Five unit tests passed; the tool successfully identifies heuristic indicators, maps them to MITRE ATT&CK, and generates AI‑assisted investigation notes without external API calls.

Workflow

• 1. Read script file as text without executing it.
• 2. Apply deterministic regex rules to detect suspicious patterns (e.g., cron persistence, remote download piped into shell, encoded PowerShell).
• 3. Record evidence, location, severity, and MITRE ATT&CK mapping.
• 4. Pass findings to local Llama 3.2 1B through Ollama for AI‑generated explanations and investigative suggestions.
• 5. Output results as a Markdown report or console display in SOC or Exorcist mode.
• 6. Run automated unit tests covering detection rules and edge cases.

Evidence

The Rootkit Exorcist reads script files as text without executing them.

Source

It uses Python regular-expression rules to identify selected suspicious command patterns and provides two reporting modes: SOC Mode and Exorcist Mode.

Source

Once the scanner identifies suspicious patterns, the findings are passed to Llama 3.2 1B through Ollama.

Source

The application has three main components: Static detection engine, Local AI interpretation, CLI reporting and testing.

Source