Detection rules › Splunk

Local LLM Framework DNS Query

Author
Rod Soto
Source
upstream

Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services. Local LLM frameworks like Ollama, LM Studio, and GPT4All make DNS calls to repositories such as huggingface.co and ollama.ai for model downloads, updates, and telemetry. These queries can reveal unauthorized AI tool usage or data exfiltration risks on corporate networks.

MITRE ATT&CK coverage

TacticTechniques
ReconnaissanceT1590 Gather Victim Network Information

Event coverage

ProviderEvent IDTitle
Sysmon22DNSEvent (DNS query)

Stages and Predicates

Stage 1: search

search NOT Image IN ("*\\MsMpEng.exe", "C:\\ProgramData\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\System32\\*") EventCode=22 QueryName IN ("*alibabacloud*", "*aliyun*", "*anthropic*", "*api.openrouter*", "*civitai*", "*dashscope.aliyuncs*", "*gpt4all*", "*huggingface*", "*jan.ai*", "*koboldai*", "*lmstudio*", "*modelscope*", "*nomic*", "*ollama*", "*oobabooga*", "*openai*", "*openrouter*", "*replicate*")

Stage 2: stats

stats BY src, Image, process_name, QueryName, query_count, answer, answer_count, reply_code_id, vendor_product

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1Imagein"*\\MsMpEng.exe", "C:\\ProgramData\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\System32\\*"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 22 corpus 15 (splunk 15)
QueryNamein
  • "*alibabacloud*"
  • "*aliyun*"
  • "*anthropic*"
  • "*api.openrouter*"
  • "*civitai*"
  • "*dashscope.aliyuncs*"
  • "*gpt4all*"
  • "*huggingface*"
  • "*jan.ai*"
  • "*koboldai*"
  • "*lmstudio*"
  • "*modelscope*"
  • "*nomic*"
  • "*ollama*"
  • "*oobabooga*"
  • "*openai*"
  • "*openrouter*"
  • "*replicate*"