The Rootkit Exorcist: Summoning Local AI to Investigate Suspicious Scripts 👻
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine The terminal is blessed. The scripts are not. What I Built For the final week of Hacktoberfest 2026, I built The Rootkit Exorcist , a Python command-line tool that scans scripts for suspicious patterns
Hacktoberfest Open-Source AI Challenge: Ghost in the Machine Submission 👻🌼
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
The terminal is blessed. The scripts are not.
For the final week of Hacktoberfest 2026, I built The Rootkit Exorcist, a Python command-line tool that scans scripts for suspicious patterns and uses locally running AI to help explain the findings.
The theme was Ghost in the Machine, and I decided to take that rather literally.
What if a cybersecurity investigation tool had an AI-powered exorcist personality?
SOC Mode: A professional, evidence-focused presentation of suspicious patterns and AI-assisted investigation notes.
Exorcist Mode: The same underlying analysis, but with Halloween flair and a theatrical AI personality I affectionately call Father Llama.
Both modes use the same static detection engine.
I'm a senior data analyst transitioning into cybersecurity, and this project gave me another opportunity to connect my analytical background with security investigation workflows.
It also gave me an excuse to put this in a terminal:
SOC Mode: Static script analysis with severity levels and MITRE ATT&CK mappings.
Markdown report: Exporting and previewing the investigation findings.
Exorcist Mode: AI-assisted explanations from Father Llama, powered by Llama 3.2 1B through Ollama.
Automated testing: Five passing unit tests.
All suspicious samples are synthetic and analyzed as text, not executed.
The complete source code for The Rootkit Exorcist is available on GitHub.
A Python-based static script analyzer that identifies potentially suspicious command patterns and uses Ollama with Llama 3.2 to generate supplementary investigation notes.
Built for the Hacktoberfest 2026 Week 4 DEV Challenge, The Rootkit Exorcist combines practical cybersecurity analysis with supernatural humor.
The Rootkit Exorcist reads script files as text without executing them.
It uses Python regular-expression rules to identify selected suspicious command patterns and provides two reporting modes:
Both modes use the same detection engine.
These are heuristic indicators, not proof…