AntiAiVi: Building an Antivirus/EDR Prototype in Python, with Static Scanning, Sysmon and Behavioural Analysis
Over the last few weeks, I have been working on the first functional version of AntiAiVi, an antivirus/EDR prototype designed to experiment with static detection techniques, real-time monitoring and behavioral analysis on Windows.
The project initially started as a Node.js codebase, but it was quickly migrated to Python because of its versatility.
AntiAiVi is not a commercial antivirus today, nor is it intended to become one in the future. It is, instead, a technical laboratory: an experimental engine for understanding how to combine static analysis, local IOCs, custom rules, event replay and Sysmon telemetry into a single CLI.
I also believe the time is right to develop this kind of project as open source and contribute to everyone’s security.
At the moment, it is still at the beginning, but it already works.
From Static Scanning to a Mini EDR
The first component we developed was the static scanner. The goal was simple: take one or more files, calculate their hashes, compare them with local indicators and analyze some suspicious characteristics.
AntiAiVi currently calculates:
SHA256;
SHA1;
MD5.
These hashes are then compared with local IOCs stored in the data/ioc directory. This makes it possible to detect known files without necessarily relying on external services.
Alongside IOCs, we also introduced a YARA-like rule system, stored in data/rules/yara-lite-rules.json. This is not yet a full YARA engine, but rather a lighter format that makes it possible to describe suspicious patterns and associate them with readable, editable rules.
This choice is useful during the prototyping phase: it allows us to quickly experiment with new detections without immediately introducing the complexity of a full YARA integration.
Suspicious Script Analysis
An important part of the project concerns script analysis. Many modern attack chains abuse interpreters that are already present on the system, such as PowerShell, Windows Script Host or batch shells.
For this reason, AntiAiVi includes dedicated checks for files such as:
PowerShell;
JavaScript;
VBScript;
BAT;
CMD.
The goal is not to fully “understand” the code, but to identify recurring signals: obfuscated commands, encoding usage, remote downloads, dynamic execution, suspicious invocations or patterns typically found in malicious payloads.
This type of analysis is particularly useful because many attacks do not start from a traditional PE executable, but from macros, scripts, PowerShell commands or lightweight droppers.
Basic PE Analysis
For Windows executable files, AntiAiVi performs an initial PE analysis. Here too, the goal is practical: to extract useful signals for risk assessment.
The engine analyzes:
PE headers;
sections;
entropy;
suspicious imports;
markers associated with packers.
High entropy, for example, may indicate compressed or encrypted sections. It is not proof of maliciousness, but it is an interesting signal when combined with other indicators, such as suspicious imports or patterns compatible with known packers.
This approach reflects an important logic: a single piece of evidence is rarely enough to classify a file. It is the combination of multiple signals that makes an object truly suspicious.
Debug Mode: Seeing What the Engine Is Doing
One of the most useful features during development is debug mode.
With:
.\antiai.cmd scan C:\Users\admin\Downloads --debug
AntiAiVi shows the checks performed on each file. This is essential for understanding not only the final result, but also the path that led to that result.
In a detection project, transparency is essential. An alert that is difficult to explain is difficult to validate, improve and correct in case of a false positive.
Debug mode therefore helps both with rule development and with verifying the behavior of the engine.
VirusTotal Integration, but Hash-Only
AntiAiVi also supports an optional VirusTotal lookup mode.
The configuration is stored in:
config/virustotal.json
It can be used with:
.\antiai.cmd scan <path> --virustotal
An important design choice is that AntiAiVi sends only hashes, not files. This approach is more careful from a privacy and data-handling perspective: the file remains local, while the external service is used only to enrich the assessment when possible.
This integration does not replace local detection; it complements it. The engine must be able to work even without cloud lookups, using IOCs, rules and internal analysis.
Real-Time Protection with the Watch Command
In addition to manual scanning, AntiAiVi includes a real-time monitoring mode:
.\antiai.cmd watch C:\Users\admin\Downloads --debug
The watch command monitors one or more folders and automatically starts a scan when new files are created or existing files are modified.
This feature brings the project closer to the behavior of a resident antivirus, even though it is still in prototype form. It is useful, for example, for observing a downloads directory or a folder used for controlled testing.
Watch mode also supports debug and quarantine, making it possible to automatically react to files considered suspicious.
Quarantine
The Python CLI includes an initial implementation of quarantine.
When enabled, AntiAiVi moves detected files to the directory:
.antiai/quarantine_py
For now, files are moved but not encrypted. Encryption has been postponed because integration with the cryptographylibrary is not yet available.
Even so, quarantine is already useful for validating the operational flow:
detection;
decision;
file movement;
preservation for later analysis.
The natural next step will be to make quarantine more robust by adding metadata, hash-based renaming, removal of the original extension and, later on, encryption.
Behavior Engine: From a Single File to an Event Chain
One of the most interesting evolutions of AntiAiVi is the behavior engine.
The static scanner looks at files. The behavior engine, instead, looks at events and tries to recognize suspicious chains.
AntiAiVi supports replay from .jsonl files:
.\antiai.cmd replay examples\events.jsonl
Each line represents an event. The engine can therefore analyze already collected sequences, simulations or logs exported from other sources.
The current behavioral detections include chains such as:
Office spawning PowerShell;
persistence;
injection;
access to LSASS;
communication with C2 domains or IP addresses.
This is an important shift in perspective. A single PowerShell process is not necessarily malicious. But an Office document spawning PowerShell, which then contacts a suspicious domain or attempts persistence, becomes a much more relevant chain.
This is where AntiAiVi starts to resemble a small EDR.
Sysmon Integration
To collect real Windows events, AntiAiVi includes a dedicated Sysmon command:
.\antiai.cmd sysmon --out examples\sysmon-events.jsonl --follow --analyze
The command reads the log:
Microsoft-Windows-Sysmon/Operational
and converts Sysmon events into JSONL format. With --follow --analyze, the engine can follow events in real time and pass them directly to behavioral analysis.
This part is particularly important because Sysmon is one of the most widely used tools in Windows environments for obtaining detailed telemetry on processes, network connections, files, registry activity and other security events.
AntiAiVi therefore does not only scan static files: it can also observe system behavior through a real log source.
Main Commands
The current CLI revolves around a few core commands.
Static scan:
.\antiai.cmd scan C:\Users\admin\Downloads --debug
Real-time monitoring:
.\antiai.cmd watch C:\Users\admin\Downloads --debug
Behavioral replay:
.\antiai.cmd replay examples\events.jsonl
Live reading and analysis from Sysmon:
.\antiai.cmd sysmon --out examples\sysmon-events.jsonl --follow --analyze
This structure makes the project easy to test and extend. Each command represents a distinct operating mode, but they all share the same detection logic.
Why Python
The move from Node.js to Python was not just a matter of convenience. For a project like AntiAiVi, Python offers several concrete advantages:
better integration with file analysis libraries;
more natural handling of binary structures;
wider availability of libraries for PE analysis, hashing, parsing and security;
simplicity when developing CLIs;
better alignment with the Windows/Sysmon ecosystem;
ease of writing tests and rapid prototypes.
Node.js remains valid for many applications, but for an experimental antivirus/EDR focused on Windows, Python proved to be more suitable.
What We Learned
The main lesson is that a modern antivirus cannot rely on a single type of analysis.
Hashes are useful, but they only detect what is already known.
Static rules help, but they can generate false positives.
PE analysis provides interesting signals, but it is rarely enough on its own.
Behavior is often more important than the file itself, but it requires well-normalized events and reliable correlations.
AntiAiVi tries to combine these layers progressively:
file → indicators → rules → scoring → events → behavior → alert
This architecture makes the project modular. Each component can improve independently without rewriting the entire system.
Next Steps
The next phase will be to make the engine more stable and easier to extend.
The main priorities are:
define a unified format for results;
introduce centralized scoring;
improve quarantine with metadata;
add structured JSON output;
create automated tests;
better normalize Sysmon events;
improve behavioral rules;
introduce allowlists and false-positive management.
One possible evolution would be to add commands such as:
.\antiai.cmd scan sample.exe --json
.\antiai.cmd quarantine list
.\antiai.cmd quarantine restore <id>
.\antiai.cmd report examples\sysmon-events.jsonl --html report.html
Before thinking about dashboards, machine learning or advanced features, it is more important to consolidate the core of the engine: consistent data, readable scoring, explainable detections and reproducible tests.
Conclusion
AntiAiVi started as an experiment, but today it is already a working foundation for studying how to build a lightweight antivirus/EDR.
The project combines static scanning, local IOCs, YARA-like rules, script analysis, PE analysis, VirusTotal via hash, real-time monitoring, quarantine, behavioral replay and Sysmon integration.
The most interesting part is not a single feature, but the whole system: AntiAiVi makes it possible to move from the file to the event, and from the event to the behavioral chain.
It is still a prototype, but it is a prototype with a clear direction: building a modular, transparent and controllable detection engine, designed to learn, experiment and improve step by step.
Commenti