This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
The terminal is blessed. The scripts are not.
What I Built
For the final week of Hacktoberfest 2026, I built The Rootkit Exorcist, a Python command-line tool that scans scripts for suspicious patterns and uses locally running AI to help explain the findings.
The theme was Ghost in the Machine, and I decided to take that rather literally.
What if a cybersecurity investigation tool had an AI-powered exorcist personality?
The result is a tool with two modes:
SOC Mode: A professional, evidence-focused presentation of suspicious patterns and AI-assisted investigation notes.
Exorcist Mode: The same underlying analysis, but with Halloween flair and a theatrical AI personality I affectionately call Father Llama.
Both modes use the same static detection engine.
I'm a senior data analyst transitioning into cybersecurity, and this project gave me another opportunity to connect my analytical background with security investigation workflows.
It also gave me an excuse to put this in a terminal:
✝ THE POWER OF CHMOD COMPELS YOU! ✝
Demo
Watch The Rootkit Exorcist in action:
The demonstration includes:
SOC Mode: Static script analysis with severity levels and MITRE ATT&CK mappings.
Markdown report: Exporting and previewing the investigation findings.
Exorcist Mode: AI-assisted explanations from Father Llama, powered by Llama 3.2 1B through Ollama.
Automated testing: Five passing unit tests.
All suspicious samples are synthetic and analyzed as text, not executed.
Code
The complete source code for The Rootkit Exorcist is available on GitHub.
Tash925
/
rootkit-exorcist
A Python CLI for static script analysis, MITRE ATT&CK mapping, and Ollama-powered investigation reports. SOC by day, exorcist by night. 👻
✝ The Rootkit Exorcist 👻
The terminal is blessed. The scripts are not.
A Python-based static script analyzer that identifies potentially suspicious command patterns and uses Ollama with Llama 3.2 to generate supplementary investigation notes.
Built for the Hacktoberfest 2026 Week 4 DEV Challenge, The Rootkit Exorcist combines practical cybersecurity analysis with supernatural humor.
✝ THE POWER OF CHMOD COMPELS YOU! ✝
What Does It Do?
The Rootkit Exorcist reads script files as text without executing them.
It uses Python regular-expression rules to identify selected suspicious command patterns and provides two reporting modes:
- SOC Mode: Professional, evidence-focused security reporting.
- Exorcist Mode: Dramatic cybersecurity commentary with a spooky personality.
Both modes use the same detection engine.
Detection Capabilities
| Rule | Detection | Severity | MITRE ATT&CK |
|---|---|---|---|
| EXO-001 | Potential cron persistence | MEDIUM | T1053.003 |
| EXO-002 | Remote download piped into a shell | HIGH | T1105 |
| EXO-003 | PowerShell encoded command | MEDIUM | T1027 |
These are heuristic indicators, not proof…
The repository includes the Python CLI, static detection rules, local Ollama integration, synthetic sample scripts, automated tests, and setup instructions.
How I Built It
I built The Rootkit Exorcist in Python, using a deterministic detection engine alongside Llama 3.2 1B running locally through Ollama.
The application has three main components:
1. Static detection engine
The scanner uses regular expressions to identify suspicious patterns, including:
| Detection | Severity | MITRE ATT&CK |
|---|---|---|
| Potential cron persistence | Medium | T1053.003 |
| Download and execute | High | T1105 |
| Encoded PowerShell commands | Medium | T1027 |
Each detection includes the matching evidence, its location in the script, and a short explanation.
These are heuristic indicators, not confirmation of malicious activity.
2. Local AI interpretation
Once the scanner identifies suspicious patterns, the findings are passed to Llama 3.2 1B through Ollama.
The model generates additional explanations and suggested investigative steps.
I experimented with two presentation styles: a professional SOC analyst voice and a dramatic Halloween exorcist voice.
The important design choice was keeping the detection logic separate from the AI-generated interpretation.
The model does not decide which detection rules matched.
3. CLI reporting and testing
The tool can export its findings and AI notes to a Markdown report.
I also added automated unit tests covering the detection rules, benign input, and a false-positive scenario involving a cron listing command.
All five tests passed.
One unexpected part of development was troubleshooting local inference inside GitHub Codespaces.
An AI request timed out while the static scanner continued to produce findings and export the report. After verifying that Ollama could respond to a smaller prompt, I successfully ran the full theatrical analysis.
I also discovered and fixed a Python indentation bug that caused an error when running without the optional report export argument.
Both experiences reinforced the value of testing the entire workflow rather than only the detection logic.
Why Does Open Innovation Matter?
Open-weight models made this project possible without depending on a hosted AI API for every investigation.
With Ollama, I could run Llama locally, experiment with different prompts, and control how the AI layer interacted with the deterministic scanner.
That flexibility mattered because I wanted to explore the boundary between identifying evidence and interpreting it.
During testing, Father Llama sometimes described suspicious commands as definitively malicious, even when the scanner had only identified patterns that required further investigation.
That was an important lesson.
AI-generated explanations are useful, but they are not evidence by themselves.
Having control over the local model and the surrounding Python workflow allowed me to experiment with that distinction directly.
Open innovation also makes projects like this approachable for learners. Someone can inspect the detection rules, change the prompts, run the model locally, and build on the idea.
There are trade-offs, including model performance and hardware limitations, but the ability to experiment openly is valuable.
The Spirit of It
Halloween gave me the creative direction, but cybersecurity gave me the underlying question.
What happens when a suspicious command appears in a script?
Does it belong there?
Is there a legitimate explanation?
What evidence would help determine the next step?
The Rootkit Exorcist doesn't answer those questions conclusively. It provides a starting point for investigation.
And despite its name, it does not detect rootkits directly or establish that a script is malicious.
It's a learning project built around static analysis, local AI experimentation, and the importance of human verification.
My favorite moment was finally getting Father Llama to deliver his full theatrical analysis after an earlier timeout.
THEATRICAL EXORCISM COMPLETE!
The project was working, the tests were passing, and the AI had officially embraced its Halloween personality.
As I continue moving from data analytics into cybersecurity, I keep returning to one idea:
The tool changes. The question doesn't.
And sometimes the question is:
Does this belong here?
Happy Hacktoberfest! 👻✝️💜
Top comments (0)