The Rootkit Exorcist: Summoning Local AI to Investigate Suspicious Scripts 👻

说明与用途

Rootkit Exorcist 工具扫描脚本中的可疑命令模式，映射到 MITRE ATT&CK，并使用本地运行的 Llama 3.2 1B 通过 Ollama 生成 AI 辅助调查说明，提供 SOC 与 Exorcist 两种报告模式，并通过自动化测试。

问题

Detect and interpret suspicious command patterns in scripts without executing them, while providing human‑readable investigation notes.

结果

Five unit tests passed; the tool successfully identifies heuristic indicators, maps them to MITRE ATT&CK, and generates AI‑assisted investigation notes without external API calls.

工作流

• 1. Read script file as text without executing it.
• 2. Apply deterministic regex rules to detect suspicious patterns (e.g., cron persistence, remote download piped into shell, encoded PowerShell).
• 3. Record evidence, location, severity, and MITRE ATT&CK mapping.
• 4. Pass findings to local Llama 3.2 1B through Ollama for AI‑generated explanations and investigative suggestions.
• 5. Output results as a Markdown report or console display in SOC or Exorcist mode.
• 6. Run automated unit tests covering detection rules and edge cases.

证据

The Rootkit Exorcist reads script files as text without executing them.

来源

It uses Python regular-expression rules to identify selected suspicious command patterns and provides two reporting modes: SOC Mode and Exorcist Mode.

来源

Once the scanner identifies suspicious patterns, the findings are passed to Llama 3.2 1B through Ollama.

来源

The application has three main components: Static detection engine, Local AI interpretation, CLI reporting and testing.

来源