title: Local LLM Inference Server Started on Linux Host
id: a1c75bd9-b78a-41f5-8339-f10e80d79a4b
status: experimental
description: Detects the start of a local LLM inference server (Ollama, llama.cpp/llama-server, LM Studio CLI, KoboldCPP, LocalAI, vLLM) on a Linux host. Relevant both for AI-assisted attack tradecraft (tooling generation, EDR evasion — see Project Black writeup) and for exposed-inference abuse — attackers increasingly deploy their own local models inside compromised environments to parse exfiltrated data and orchestrate follow-on actions without touching a provider API.
references:
    - https://projectblack.io/blog/bypassing-edr-with-local-ai/
    - https://www.greynoise.io/blog/threat-actors-actively-targeting-llms
    - https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
author: Agentic Threat Lab
date: 2026-10-23
tags:
    - attack.discovery
atlas:
    - AML.T0132
logsource:
    category: process_creation
    product: linux
detection:
    selection_image:
        Image|endswith:
            - '/ollama'
            - '/ollama-app'
            - '/llama-server'
            - '/lms'
            - '/koboldcpp'
            - '/localai'
    selection_cli:
        CommandLine|contains:
            - 'vllm serve'
            - 'ollama serve'
            - '-m vllm'
            - 'python3 -m vllm'
            - 'text-generation-webui'
    condition: selection_image or selection_cli
falsepositives:
    - Legitimate development/inference workloads (baseline expected hosts)
    - Container images bundling inference runtimes; correlate with container parentage where available
level: informational