splApache-2.0from splunk/security_content

Local LLM Framework DNS Query

Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services. Local LLM frameworks like Ollama, LM Studio, and GPT4All make DNS calls to repositories such as huggingface.co and ollama.ai for model downloads, updates, and telemetry. These queries can reveal unauthorized AI tool usage or data exfiltration risks on corporate networks.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/local_llm_framework_dns_query.yml

`sysmon`
EventCode=22
QueryName IN (
    "*huggingface*",
    "*ollama*",
    "*jan.ai*",
    "*gpt4all*",
    "*nomic*",
    "*koboldai*",
    "*lmstudio*",
    "*modelscope*",
    "*civitai*",
    "*oobabooga*",
    "*replicate*",
    "*anthropic*",
    "*openai*",
    "*openrouter*",
    "*api.openrouter*",
    "*aliyun*",
    "*alibabacloud*",
    "*dashscope.aliyuncs*"
)
NOT Image IN (
    "*\\MsMpEng.exe",
    "C:\\ProgramData\\*",
    "C:\\Windows\\System32\\*",
    "C:\\Windows\\SysWOW64\\*"
)
| stats count
    min(_time) as firstTime
    max(_time) as lastTime
    by src Image process_name QueryName query_count answer answer_count reply_code_id vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `local_llm_framework_dns_query_filter`