title: Local LLM Inference Server Started on Windows Endpoint
id: 42f6f53d-5678-4f23-b5cb-8e4039d5ab38
status: experimental
description: Detects the start of a local LLM inference server (Ollama, llama.cpp/llama-server, LM Studio, KoboldCPP, LocalAI, TabbyAPI, vLLM, text-generation-webui) on a Windows endpoint. Local inference on workstations is the enabling condition for AI-authored tooling and EDR-evasion tradecraft documented in 2026 (e.g. uncensored open-weight models generating LSASS-dumping tooling on-host — see Project Black), as well as a data-exfiltration and shadow-IT risk. Sigma-native complement to Splunk's "Suspicious Local LLM Frameworks" analytic story (May 2026).
references:
    - https://projectblack.io/blog/bypassing-edr-with-local-ai/
    - https://research.splunk.com/stories/
    - https://www.greynoise.io/blog/threat-actors-actively-targeting-llms
author: Agentic Threat Lab
date: 2026-10-23
tags:
    - attack.discovery
atlas:
    - AML.T0132
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\ollama.exe'
            - '\llama-server.exe'
            - '\lms.exe'
            - '\lmstudio.exe'
            - '\koboldcpp.exe'
            - '\localai.exe'
            - '\tabbyapi.exe'
            - '\oobabooga.exe'
    selection_cli:
        CommandLine|contains:
            - 'vllm serve'
            - 'ollama serve'
            - 'python -m vllm'
            - 'text-generation-webui'
    condition: selection_image or selection_cli
falsepositives:
    - Developers and ML engineers running local models legitimately (baseline expected hosts, alert on the rest)
    - Software bundling llama.cpp runtimes (some desktop AI apps); tune per environment
level: informational