Skip to content
Threat Feed
Subscribe

Vendor

LM Studio

3 briefs RSS
medium advisory

Detection of Local LLM Framework DNS Queries

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

Claude +16 local-llm shadow-ai dns-monitoring data-exfiltration policy-violation windows endpoint-security
1r 3t 18i
medium threat

Detection of Generative AI Processes Connecting to Unusual Domains

Adversaries may compromise macOS-based Generative AI (GenAI) tools through prompt injection, malicious Model Context Protocol (MCP) servers, or poisoned plugins to establish Command and Control (C2) channels or exfiltrate sensitive data by causing them to connect to unusual domains.

exploited Claude +8 command-and-control genai macos data-exfiltration
1r 1t
medium advisory

GenAI Process Performing Encoding/Chunking Prior to Network Activity

This rule detects GenAI processes performing encoding or chunking (base64, gzip, tar, zip) followed by outbound network activity, indicating data preparation for exfiltration.

Ollama +2 genai exfiltration defense-evasion
2r 4t