The Rootkit Exorcist: Summoning Local AI to Investigate Suspicious Scripts 👻

Описание и применение

Инструмент The Rootkit Exorcist сканирует скрипты на наличие подозрительных команд, сопоставляет их с MITRE ATT&CK и генерирует пояснения с помощью локальной модели Llama 3.2 1B через Ollama. Он предоставляет два режима отчёта – профессиональный SOC и театральный Exorcist, а также проходит автоматические тесты.

Задача

Detect and interpret suspicious command patterns in scripts without executing them, while providing human‑readable investigation notes.

Результат

Five unit tests passed; the tool successfully identifies heuristic indicators, maps them to MITRE ATT&CK, and generates AI‑assisted investigation notes without external API calls.

Рабочий процесс

• 1. Read script file as text without executing it.
• 2. Apply deterministic regex rules to detect suspicious patterns (e.g., cron persistence, remote download piped into shell, encoded PowerShell).
• 3. Record evidence, location, severity, and MITRE ATT&CK mapping.
• 4. Pass findings to local Llama 3.2 1B through Ollama for AI‑generated explanations and investigative suggestions.
• 5. Output results as a Markdown report or console display in SOC or Exorcist mode.
• 6. Run automated unit tests covering detection rules and edge cases.

Доказательства

The Rootkit Exorcist reads script files as text without executing them.

Источник

It uses Python regular-expression rules to identify selected suspicious command patterns and provides two reporting modes: SOC Mode and Exorcist Mode.

Источник

Once the scanner identifies suspicious patterns, the findings are passed to Llama 3.2 1B through Ollama.

Источник

The application has three main components: Static detection engine, Local AI interpretation, CLI reporting and testing.

Источник