From ea05a1788924d1f50dc55f21e4bac129dfefe744 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Thu, 24 Sep 2026 01:27:28 +0200 Subject: [PATCH 1/9] promote ai content to prod --- .../m365_copilot_agentic_jailbreak_attack.yml | 9 ++++----- .../m365_copilot_impersonation_jailbreak_attack.yml | 9 ++++----- ...5_copilot_information_extraction_jailbreak_attack.yml | 9 ++++----- .../application/m365_copilot_jailbreak_attempts.yml | 9 ++++----- .../application/ollama_abnormal_network_connectivity.yml | 9 ++++----- ...ollama_abnormal_service_crash_availability_attack.yml | 9 ++++----- detections/application/ollama_excessive_api_requests.yml | 9 ++++----- .../ollama_possible_api_endpoint_scan_reconnaissance.yml | 9 ++++----- .../ollama_possible_memory_exhaustion_resource_abuse.yml | 9 ++++----- .../ollama_possible_model_exfiltration_data_leakage.yml | 9 ++++----- .../ollama_possible_rce_via_model_loading.yml | 9 ++++----- .../ollama_suspicious_prompt_injection_jailbreak.yml | 9 ++++----- 12 files changed, 48 insertions(+), 60 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index e73d2df500c..35a15b9a776 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Agentic Jailbreak Attack id: e5c7b380-19da-42e9-9e53-0af4cd27aee3 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts. data_source: @@ -61,5 +61,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index cba621255af..1851a3ebc3a 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 6 +version: 7 creation_date: '2025-10-13' -modification_date: '2026-06-04' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks. data_source: @@ -53,5 +53,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 9edff8c36cc..e8c6e4eceef 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Information Extraction Jailbreak Attack id: c0ee37bb-ed43-4632-8e38-060fba80b0b2 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation. data_source: @@ -92,5 +92,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 28c8410f745..3e100b03d3e 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -1,10 +1,10 @@ name: M365 Copilot Jailbreak Attempts id: b05a4f25-e07d-436f-ab03-f954afa922c0 -version: 6 +version: 7 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption. data_source: @@ -66,5 +66,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index c12fe51364c..9c9449d94c7 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -1,10 +1,10 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity. data_source: @@ -61,5 +61,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_abnormal_service_crash_availability_attack.yml b/detections/application/ollama_abnormal_service_crash_availability_attack.yml index e37ebbe1b63..e1deb62e1da 100644 --- a/detections/application/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/application/ollama_abnormal_service_crash_availability_attack.yml @@ -1,10 +1,10 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability. data_source: @@ -46,5 +46,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 42f4958876a..78a2483ca61 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -1,10 +1,10 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. data_source: @@ -46,5 +46,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index aa1b54cd733..e62daea2eb4 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -1,10 +1,10 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. data_source: @@ -58,5 +58,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 6b9e2b38cbc..4e6e044c26a 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -1,10 +1,10 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. data_source: @@ -46,5 +46,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/application/ollama_possible_model_exfiltration_data_leakage.yml index 3140267adc4..a071a5f021f 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/application/ollama_possible_model_exfiltration_data_leakage.yml @@ -1,10 +1,10 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: @@ -46,5 +46,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_rce_via_model_loading.yml b/detections/application/ollama_possible_rce_via_model_loading.yml index be366b8ce8f..37bdd3a9ba7 100644 --- a/detections/application/ollama_possible_rce_via_model_loading.yml +++ b/detections/application/ollama_possible_rce_via_model_loading.yml @@ -1,10 +1,10 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes. data_source: @@ -46,5 +46,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml index 3fdfeb434f1..48843d05be6 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml @@ -1,10 +1,10 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: @@ -48,5 +48,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit From 90fb4ed078d3fde6029b606267071733be3a59db Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Thu, 24 Sep 2026 13:23:16 +0200 Subject: [PATCH 2/9] update test links --- .../application/m365_copilot_agentic_jailbreak_attack.yml | 2 +- .../application/m365_copilot_impersonation_jailbreak_attack.yml | 2 +- .../m365_copilot_information_extraction_jailbreak_attack.yml | 2 +- detections/application/m365_copilot_jailbreak_attempts.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index 35a15b9a776..da9daccc56e 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -58,7 +58,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: unit diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index 1851a3ebc3a..081d51f5843 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -50,7 +50,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: unit diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index e8c6e4eceef..2d897111849 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -89,7 +89,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: unit diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 3e100b03d3e..a0afa8c77eb 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -63,7 +63,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: unit From c2bfa2cfed0309eb690166ca028a3e91bc441b04 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Thu, 24 Sep 2026 13:53:16 +0200 Subject: [PATCH 3/9] Update ollama_suspicious_prompt_injection_jailbreak.yml --- ..._suspicious_prompt_injection_jailbreak.yml | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml index 48843d05be6..77d250b7c04 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml @@ -6,10 +6,34 @@ modification_date: '2026-09-24' author: Rod Soto status: production type: Anomaly -description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. +description: |- + Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. + Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. + This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: - Ollama Server -search: '`ollama_server` "GIN" ("*/api/generate*" OR "*/v1/chat/completions*") | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+[a-z]+)\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | rex field=response_time "^(?:(?\d+)m)?(?[\d\.]+)s$" | eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) | eval src=src_ip | where response_time_seconds > 30 | bin _time span=10m | stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host | where long_request_count > 170 | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) | eval attack_type="Potential Prompt Injection / Jailbreak" | table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type | `ollama_suspicious_prompt_injection_jailbreak_filter`' +search: |- + `ollama_server` + "GIN" + ( + "*/api/generate*" + OR + "*/v1/chat/completions*" + ) + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+[a-z]+)\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + | rex field=response_time "^(?:(?\d+)m)?(?[\d\.]+)s$" + | eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) + | eval src=src_ip + | where response_time_seconds > 30 + | bin _time span=10m + | stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host + | where long_request_count > 55 + | eval avg_response_time=round(avg_response_time, 2) + | eval max_response_time=round(max_response_time, 2) + | eval severity=case(long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) + | eval attack_type="Potential Prompt Injection / Jailbreak" + | table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type + | `ollama_suspicious_prompt_injection_jailbreak_filter` how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' known_false_positives: Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. references: From 3f680be99f2a14a134899e1a4cbffea38aef2514 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 28 Sep 2026 11:29:44 +0200 Subject: [PATCH 4/9] revert m365 copilot rules reverting this batch since the test is broken and needs to be looked at. --- .../m365_copilot_agentic_jailbreak_attack.yml | 9 +++++---- .../m365_copilot_impersonation_jailbreak_attack.yml | 9 +++++---- ...5_copilot_information_extraction_jailbreak_attack.yml | 9 +++++---- .../application/m365_copilot_jailbreak_attempts.yml | 9 +++++---- 4 files changed, 20 insertions(+), 16 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index da9daccc56e..a22f6aa76c0 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Agentic Jailbreak Attack id: e5c7b380-19da-42e9-9e53-0af4cd27aee3 -version: 6 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-05-13' author: Rod Soto -status: production +status: experimental type: Anomaly description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts. data_source: @@ -61,4 +61,5 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: unit + test_type: experimental + description: This test is a legacy experimental test and may not be accurate. diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index 081d51f5843..29c1f7eb3fb 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 7 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-06-04' author: Rod Soto -status: production +status: experimental type: TTP description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks. data_source: @@ -53,4 +53,5 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: unit + test_type: experimental + description: This test is a legacy experimental test and may not be accurate. diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 2d897111849..1b0851af8d2 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Information Extraction Jailbreak Attack id: c0ee37bb-ed43-4632-8e38-060fba80b0b2 -version: 6 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-05-13' author: Rod Soto -status: production +status: experimental type: TTP description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation. data_source: @@ -92,4 +92,5 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: unit + test_type: experimental + description: This test is a legacy experimental test and may not be accurate. diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index a0afa8c77eb..9a9631a57bd 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -1,10 +1,10 @@ name: M365 Copilot Jailbreak Attempts id: b05a4f25-e07d-436f-ab03-f954afa922c0 -version: 7 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-05-13' author: Rod Soto -status: production +status: experimental type: Anomaly description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption. data_source: @@ -66,4 +66,5 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv - test_type: unit + test_type: experimental + description: This test is a legacy experimental test and may not be accurate. From 6f1db1c42b0b9401ae601c32017dd8845db0c74a Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 10:37:46 +0200 Subject: [PATCH 5/9] update ai content based on review --- detections/application/ollama_excessive_api_requests.yml | 6 +++--- .../ollama_possible_api_endpoint_scan_reconnaissance.yml | 8 +++++--- .../ollama_possible_memory_exhaustion_resource_abuse.yml | 4 ++-- .../ollama_possible_model_exfiltration_data_leakage.yml | 6 +++--- 4 files changed, 13 insertions(+), 11 deletions(-) diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 78a2483ca61..9183d7ad2dd 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -2,14 +2,14 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-09-29' author: Rod Soto status: production type: Anomaly description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`' +search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count, values(dest) as dest by _time, src, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | `ollama_excessive_api_requests_filter`' how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. references: @@ -28,7 +28,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability. + message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 5 minutes, potentially causing service degradation or complete unavailability. analytic_story: - Suspicious Ollama Activities asset_type: Web Application diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index e62daea2eb4..8a89a25e124 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -2,7 +2,7 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 version: 6 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-09-29' author: Rod Soto status: production type: Anomaly @@ -11,10 +11,12 @@ data_source: - Ollama Server search: |- `ollama_server` "[GIN]" + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+)s\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + | eval src=src_ip | bin _time span=5m - | stats count as total_requests, values(dest) as dest, values(http_method) as methods, values(status) as status_codes + | stats count as total_requests, dc(uri_path) as distinct_endpoints, count(eval(http_method="HEAD")) as head_requests, values(uri_path) as dest, values(http_method) as methods, values(status_code) as status_codes BY _time, src, host - | where total_requests > 120 + | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) | eval severity="medium" | eval attack_type="API Activity Surge" | stats count diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 4e6e044c26a..8412fad0276 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -2,14 +2,14 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-09-29' author: Rod Soto status: production type: Anomaly description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. data_source: - Ollama Server -search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' +search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, max(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 10 OR total_runners > 5 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000 OR total_runners > 10, "critical", max_memory > 400 OR operations > 20 OR total_runners > 5, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. references: diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/application/ollama_possible_model_exfiltration_data_leakage.yml index a071a5f021f..12123fe5d92 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/application/ollama_possible_model_exfiltration_data_leakage.yml @@ -2,14 +2,14 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-09-29' author: Rod Soto status: production type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+)s\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where response_time > 55 | bin _time span=15m | stats count, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, dest, uri_path | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | stats count by _time, src, uri_path, avg_response_time, max_response_time, severity, attack_type | `ollama_possible_model_exfiltration_data_leakage_filter`' +search: '`ollama_server` | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+)s\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where tonumber(response_time) > 55 AND in(uri_path, "/api/show", "/api/tags", "/api/v1/models") | bin _time span=15m | stats count as inspection_attempts, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, uri_path | where inspection_attempts >= 2 | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | `ollama_possible_model_exfiltration_data_leakage_filter`' how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' known_false_positives: Legitimate administrative activities such as model inventory management, monitoring dashboards polling model status, automated health checks verifying model availability, CI/CD pipelines validating deployments, development tools inspecting model configurations, or users browsing available models through management interfaces may trigger this detection during normal operations. Adjust the threshold based on your environment's baseline activity. references: @@ -28,7 +28,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Potential model data exfiltration detected from $src$ with $avg_response_time$ attempts across endpoints, indicating systematic extraction of sensitive model configurations, architecture details, and proprietary customizations that may constitute intellectual property theft. + message: Potential model data exfiltration detected from $src$ with $inspection_attempts$ slow inspection attempts to $uri_path$ in 15 minutes, indicating systematic extraction of sensitive model configurations, architecture details, and proprietary customizations that may constitute intellectual property theft. analytic_story: - Suspicious Ollama Activities asset_type: Web Application From 584513f7f6140f2f4dfe8ba16bc0d742dae6f28c Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:40:24 +0200 Subject: [PATCH 6/9] revert link change --- .../application/m365_copilot_agentic_jailbreak_attack.yml | 2 +- .../application/m365_copilot_impersonation_jailbreak_attack.yml | 2 +- .../m365_copilot_information_extraction_jailbreak_attack.yml | 2 +- detections/application/m365_copilot_jailbreak_attempts.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index 58ef11c6b21..ba76b389cfb 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -58,7 +58,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: experimental diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index 99de163c528..4659c8a4b80 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -50,7 +50,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: experimental diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 567a1af269a..b856ed88224 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -89,7 +89,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: experimental diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 8115ccbd7f7..ca4445a5654 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -63,7 +63,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/m365_copilot/copilot_prompt_logs.csv + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv sourcetype: csv source: csv test_type: experimental From 4eb510641318a9d837ceff3c3ae7933be848f973 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sat, 10 Oct 2026 01:45:53 +0200 Subject: [PATCH 7/9] update ollama content --- .../ollama_abnormal_network_connectivity.yml | 81 ++++++++++------ .../ollama_excessive_api_requests.yml | 54 +++++++++-- ...ollama_long_running_inference_requests.yml | 96 +++++++++++++++++++ ...sible_api_endpoint_scan_reconnaissance.yml | 73 +++++++++----- ...sible_memory_exhaustion_resource_abuse.yml | 62 ++++++++++-- .../ollama_repeated_application_errors.yml | 85 ++++++++++++++++ ...rmal_service_crash_availability_attack.yml | 9 +- ...ssible_model_exfiltration_data_leakage.yml | 15 ++- .../ollama_possible_rce_via_model_loading.yml | 8 +- ..._suspicious_prompt_injection_jailbreak.yml | 37 ++----- 10 files changed, 415 insertions(+), 105 deletions(-) create mode 100644 detections/application/ollama_long_running_inference_requests.yml create mode 100644 detections/application/ollama_repeated_application_errors.yml rename detections/{application => deprecated}/ollama_abnormal_service_crash_availability_attack.yml (90%) rename detections/{application => deprecated}/ollama_possible_model_exfiltration_data_leakage.yml (72%) rename detections/{application => deprecated}/ollama_possible_rce_via_model_loading.yml (92%) rename detections/{application => deprecated}/ollama_suspicious_prompt_injection_jailbreak.yml (53%) diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index 9c9449d94c7..80a853f306c 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -2,53 +2,78 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb version: 6 creation_date: '2025-10-13' -modification_date: '2026-09-24' -author: Rod Soto +modification_date: '2026-10-10' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity. +description: |- + Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance. data_source: - Ollama Server search: |- - `ollama_server` level=WARN (msg="*failed*" OR msg="*dial tcp*" OR msg="*lookup*" OR msg="*no such host*" OR msg="*connection*" OR msg="*network*" OR msg="*timeout*" OR msg="*unreachable*" OR msg="*refused*") - | eval src=coalesce(src, src_ip, "N/A") - | stats count as incidents, values(src) as src, values(msg) as warning_messages, latest(_time) as last_incident - BY host - | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") - | eval severity="medium" - | eval attack_type="Abnormal Network Connectivity" - | stats count - BY last_incident, host, incidents, - src, warning_messages, severity, - attack_type - | `ollama_abnormal_network_connectivity_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. + `ollama_server` + level=WARN + msg IN ( + "*connection*", + "*dial tcp*", + "*failed*", + "*lookup*", + "*network*", + "*no such host*", + "*refused*" + "*timeout*", + "*unreachable*" + ) + + | bin _time span=5m + | stats count as incidents + values(msg) as warning_messages + latest(_time) as last_incident + by _time dest + + | where incidents > 3 + + | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") + + | eval severity="medium" + + | eval attack_type="Abnormal Network Connectivity" + + | table last_incident dest incidents warning_messages severity attack_type + + | `ollama_abnormal_network_connectivity_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + - name: View the detection results for - "$dest$" + search: |- + %original_detection_search% + | search dest="$dest$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$",) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$dest$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: entities: - - field: host + - field: dest type: system score: 20 - message: 'Abnormal network activity detected on $host$ with $incidents$ incidents from $src$. Investigation needed for network errors: $warning_messages$.' -threat_objects: - - field: src - type: system + message: Abnormal network activity on [$dest$] with [$incidents$] matching warnings [$warning_messages$]. Investigate DNS and network reachability. analytic_story: - Suspicious Ollama Activities asset_type: Web Application -mitre_attack_id: - - T1571 +mitre_attack_id: [] product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 9183d7ad2dd..76eb6313a1f 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -2,25 +2,61 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-29' -author: Rod Soto +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. +description: Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count, values(dest) as dest by _time, src, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | `ollama_excessive_api_requests_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) + + | bin _time span=5m + + | stats count as request_count + dc(uri_path) as distinct_endpoints + values(uri_path) as endpoints + by _time src + + | where request_count > 120 + + | eval severity="medium" + + | eval attack_type="High Volume API Activity" + + | `ollama_excessive_api_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +64,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 5 minutes, potentially causing service degradation or complete unavailability. + message: '[$request_count$] Ollama API requests from [$src$] across [$distinct_endpoints$] endpoints were observed in 5 minutes. Validate the client and workload before attributing the burst to abuse or service impact.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml new file mode 100644 index 00000000000..00dcc0d04d1 --- /dev/null +++ b/detections/application/ollama_long_running_inference_requests.yml @@ -0,0 +1,96 @@ +name: Ollama Long-Running Inference Requests +id: 7619c98c-f53b-445f-87ca-b148e8560340 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions. + Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal. +data_source: + - Ollama Server +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000 + + | eval response_time_seconds=response_time_ms/1000 + + | bin _time span=10m + + | stats count as long_request_count + avg(response_time_seconds) as avg_response_time + max(response_time_seconds) as max_response_time + values(uri_path) as uri_path + values(http_response_code) as status_codes + by _time src host + + | where long_request_count > 1 + + | eval avg_response_time=round(avg_response_time, 2) + | eval max_response_time=round(max_response_time, 2) + | eval severity=case(max_response_time > 55, "high", 1=1, "medium") + | eval attack_type="Long-Running Inference Requests" + + | table _time host src uri_path long_request_count + avg_response_time max_response_time + status_codes severity attack_type + + | `ollama_long_running_inference_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. +references: + - https://github.com/rosplk/ta-ollama + - https://github.com/OWASP/www-project-ai-testing-guide +drilldown_searches: + - name: View the detection results for - "$src$" + search: |- + %original_detection_search% + | search src="$src$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: '[$long_request_count$] long-running inference requests from [$src$] averaged [$avg_response_time$] seconds and reached [$max_response_time$] seconds. Investigate workload, model size, prompt length, and host capacity; access logs do not establish prompt injection or data exfiltration.' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log + sourcetype: ollama:server + source: server.log + test_type: unit diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index 8a89a25e124..524253871e7 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -2,39 +2,68 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 version: 6 creation_date: '2025-10-13' -modification_date: '2026-09-29' -author: Rod Soto +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. +description: |- + Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. data_source: - Ollama Server search: |- - `ollama_server` "[GIN]" - | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+)s\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" - | eval src=src_ip - | bin _time span=5m - | stats count as total_requests, dc(uri_path) as distinct_endpoints, count(eval(http_method="HEAD")) as head_requests, values(uri_path) as dest, values(http_method) as methods, values(status_code) as status_codes - BY _time, src, host - | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) - | eval severity="medium" - | eval attack_type="API Activity Surge" - | stats count - BY _time, host, src, - total_requests, dest, methods, - status_codes, severity, attack_type - | `ollama_possible_api_endpoint_scan_reconnaissance_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) AND isnotnull(uri_path) + + | bin _time span=5m + + | stats count as total_requests + dc(uri_path) as distinct_endpoints + count(eval(http_method="HEAD")) as head_requests + values(uri_path) as endpoints + values(http_method) as methods + values(http_response_code) as status_codes + by _time src host + + | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) + + | eval severity="medium" + | eval attack_type="API Activity Surge" + + | table _time host src total_requests + distinct_endpoints endpoints methods + status_codes severity attack_type + + | `ollama_possible_api_endpoint_scan_reconnaissance_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -42,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: API reconnaissance activity detected from $src$ on $host$ with $total_requests$ requests across different endpoints using methods $methods$ and receiving status codes $status_codes$, indicating systematic endpoint enumeration to map API attack surface and identify potential vulnerabilities. + message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].' analytic_story: - Suspicious Ollama Activities asset_type: Web Application diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 8412fad0276..a124408fcbb 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -2,25 +2,69 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-29' -author: Rod Soto +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. +description: |- + Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines. data_source: - Ollama Server -search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, max(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 10 OR total_runners > 5 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000 OR total_runners > 10, "critical", max_memory > 400 OR operations > 20 OR total_runners > 5, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. +search: |- + `ollama_server` + ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") + + | rex field=_raw "count=(?\d+)" + | rex field=_raw "(?[\d\.]+)\s+MiB" + | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" + | rex field=_raw "source=(?[^\s]+)" + + | bin _time span=5m + + | stats count as operations + avg(load_time) as avg_load_time + avg(memory_mb) as avg_memory + dc(code_source) as unique_sources + max(load_time) as max_load_time + max(memory_mb) as max_memory + max(runner_count) as peak_loaded_runners + values(code_source) as code_sources + by _time host + + | where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400 + + | eval avg_memory=round(avg_memory, 2) + | eval max_memory=round(max_memory, 2) + | eval avg_load_time=round(avg_load_time, 2) + | eval max_load_time=round(max_load_time, 2) + | eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low") + | eval attack_type="Resource Pressure / Memory Allocation" + + | table _time host operations peak_loaded_runners + unique_sources avg_memory max_memory + avg_load_time max_load_time severity attack_type + + | `ollama_possible_memory_exhaustion_resource_abuse_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$host$" - search: '%original_detection_search% | search "$host = "$host$"' + search: |- + %original_detection_search% + | search host="$host$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +72,7 @@ intermediate_findings: - field: host type: system score: 20 - message: Potential resource exhaustion attack detected on $host$ with $operations$ memory operations in 5 minutes, utilizing $max_memory$ MiB peak memory and $total_runners$ runners, indicating possible attempts to exhaust system resources through excessive model loading or memory abuse. + message: 'Ollama resource pressure indicators on [$host$]: [$peak_loaded_runners$] peak loaded runners and [$max_memory$] MiB largest observed buffer across [$operations$] log events in 5 minutes. Compare with expected workloads before escalation.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml new file mode 100644 index 00000000000..0dd0538dec1 --- /dev/null +++ b/detections/application/ollama_repeated_application_errors.yml @@ -0,0 +1,85 @@ +name: Ollama Repeated Application Errors +id: e0fff27e-ee9b-4b8d-b247-f93a93cefa71 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry. +data_source: + - Ollama Server +search: |- + `ollama_server` + (level=ERROR OR level=FATAL) + + | rex field=_raw "msg=\"(?[^\"]+)\"" + | rex field=_raw "exit_code=(?\d+)" + + | bin _time span=5m + + | stats count as error_count + earliest(_time) as first_seen + latest(_time) as last_seen + values(msg) as error_messages + values(exit_code) as exit_codes + dc(msg) as unique_errors + by _time host + + | where error_count > 1 + + | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") + | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") + | eval severity=case(error_count > 5, "critical", error_count > 2, "high", 1=1, "medium") + | eval attack_type="Repeated Ollama Application Errors" + + | table first_seen last_seen host error_count + unique_errors error_messages severity attack_type + + | `ollama_repeated_application_errors_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage. +references: + - https://github.com/rosplk/ta-ollama +drilldown_searches: + - name: View the detection results for - "$host$" + search: |- + %original_detection_search% + | search host="$host$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: 'Repeated Ollama application errors detected on host [$host$] between [$first_seen$] and [$last_seen$]: [$error_count$] events and [$unique_errors$] unique error types. Correlate with service manager logs to determine whether availability was affected. Error messages: [$error_messages$].' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log + sourcetype: ollama:server + source: app.log + test_type: unit diff --git a/detections/application/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml similarity index 90% rename from detections/application/ollama_abnormal_service_crash_availability_attack.yml rename to detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml index e1deb62e1da..e515f0f7788 100644 --- a/detections/application/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml @@ -2,9 +2,9 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-10-10' author: Rod Soto -status: production +status: deprecated type: Anomaly description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability. data_source: @@ -47,3 +47,8 @@ tests: sourcetype: ollama:server source: app.log test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Repeated Application Errors diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml similarity index 72% rename from detections/application/ollama_possible_model_exfiltration_data_leakage.yml rename to detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml index 12123fe5d92..c9c90c40c80 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml @@ -2,14 +2,14 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-29' +modification_date: '2026-10-10' author: Rod Soto -status: production +status: deprecated type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+)s\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where tonumber(response_time) > 55 AND in(uri_path, "/api/show", "/api/tags", "/api/v1/models") | bin _time span=15m | stats count as inspection_attempts, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, uri_path | where inspection_attempts >= 2 | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | `ollama_possible_model_exfiltration_data_leakage_filter`' +search: '`ollama_server` | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+)s\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where response_time > 55 | bin _time span=15m | stats count, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, dest, uri_path | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | stats count by _time, src, uri_path, avg_response_time, max_response_time, severity, attack_type | `ollama_possible_model_exfiltration_data_leakage_filter`' how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' known_false_positives: Legitimate administrative activities such as model inventory management, monitoring dashboards polling model status, automated health checks verifying model availability, CI/CD pipelines validating deployments, development tools inspecting model configurations, or users browsing available models through management interfaces may trigger this detection during normal operations. Adjust the threshold based on your environment's baseline activity. references: @@ -28,7 +28,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Potential model data exfiltration detected from $src$ with $inspection_attempts$ slow inspection attempts to $uri_path$ in 15 minutes, indicating systematic extraction of sensitive model configurations, architecture details, and proprietary customizations that may constitute intellectual property theft. + message: Potential model data exfiltration detected from $src$ with $avg_response_time$ attempts across endpoints, indicating systematic extraction of sensitive model configurations, architecture details, and proprietary customizations that may constitute intellectual property theft. analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,4 +46,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: unit + test_type: experimental + description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml similarity index 92% rename from detections/application/ollama_possible_rce_via_model_loading.yml rename to detections/deprecated/ollama_possible_rce_via_model_loading.yml index 37bdd3a9ba7..f8092aad772 100644 --- a/detections/application/ollama_possible_rce_via_model_loading.yml +++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml @@ -2,9 +2,9 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-10-10' author: Rod Soto -status: production +status: deprecated type: Anomaly description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes. data_source: @@ -47,3 +47,7 @@ tests: sourcetype: ollama:server source: app.log test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml similarity index 53% rename from detections/application/ollama_suspicious_prompt_injection_jailbreak.yml rename to detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml index 77d250b7c04..f415cb95fb3 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml @@ -2,38 +2,14 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f version: 5 creation_date: '2025-10-13' -modification_date: '2026-09-24' +modification_date: '2026-10-10' author: Rod Soto -status: production +status: deprecated type: Anomaly -description: |- - Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. - Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. - This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. +description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: - Ollama Server -search: |- - `ollama_server` - "GIN" - ( - "*/api/generate*" - OR - "*/v1/chat/completions*" - ) - | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+[a-z]+)\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" - | rex field=response_time "^(?:(?\d+)m)?(?[\d\.]+)s$" - | eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) - | eval src=src_ip - | where response_time_seconds > 30 - | bin _time span=10m - | stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host - | where long_request_count > 55 - | eval avg_response_time=round(avg_response_time, 2) - | eval max_response_time=round(max_response_time, 2) - | eval severity=case(long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) - | eval attack_type="Potential Prompt Injection / Jailbreak" - | table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type - | `ollama_suspicious_prompt_injection_jailbreak_filter` +search: '`ollama_server` "GIN" ("*/api/generate*" OR "*/v1/chat/completions*") | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+[a-z]+)\s+\|\s+(?[\:\da-f\.]+)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | rex field=response_time "^(?:(?\d+)m)?(?[\d\.]+)s$" | eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) | eval src=src_ip | where response_time_seconds > 30 | bin _time span=10m | stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host | where long_request_count > 170 | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) | eval attack_type="Potential Prompt Injection / Jailbreak" | table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type | `ollama_suspicious_prompt_injection_jailbreak_filter`' how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' known_false_positives: Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. references: @@ -73,3 +49,8 @@ tests: sourcetype: ollama:server source: server.log test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Long-Running Inference Requests From 47ad08dd1a273b6f9ff22557146fa86255a076da Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sat, 10 Oct 2026 01:49:39 +0200 Subject: [PATCH 8/9] fix date --- detections/application/ollama_abnormal_network_connectivity.yml | 2 +- .../ollama_abnormal_service_crash_availability_attack.yml | 2 +- .../ollama_possible_model_exfiltration_data_leakage.yml | 2 +- detections/deprecated/ollama_possible_rce_via_model_loading.yml | 2 +- .../deprecated/ollama_suspicious_prompt_injection_jailbreak.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index 80a853f306c..c3a18bb8754 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -2,7 +2,7 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb version: 6 creation_date: '2025-10-13' -modification_date: '2026-10-10' +modification_date: '2026-10-09' author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Anomaly diff --git a/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml index e515f0f7788..9c14555e326 100644 --- a/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml @@ -2,7 +2,7 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa version: 5 creation_date: '2025-10-13' -modification_date: '2026-10-10' +modification_date: '2026-10-09' author: Rod Soto status: deprecated type: Anomaly diff --git a/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml index c9c90c40c80..f04b73cb26f 100644 --- a/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml @@ -2,7 +2,7 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb version: 5 creation_date: '2025-10-13' -modification_date: '2026-10-10' +modification_date: '2026-10-09' author: Rod Soto status: deprecated type: Anomaly diff --git a/detections/deprecated/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml index f8092aad772..8fdeddd5eea 100644 --- a/detections/deprecated/ollama_possible_rce_via_model_loading.yml +++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml @@ -2,7 +2,7 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 version: 5 creation_date: '2025-10-13' -modification_date: '2026-10-10' +modification_date: '2026-10-09' author: Rod Soto status: deprecated type: Anomaly diff --git a/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml index f415cb95fb3..691b8187d54 100644 --- a/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml @@ -2,7 +2,7 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f version: 5 creation_date: '2025-10-13' -modification_date: '2026-10-10' +modification_date: '2026-10-09' author: Rod Soto status: deprecated type: Anomaly From 20bdf8097e5412ee9c01ec23f0d3f0301748681d Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sat, 10 Oct 2026 02:02:33 +0200 Subject: [PATCH 9/9] codex fixes --- .../application/ollama_abnormal_network_connectivity.yml | 2 +- .../application/ollama_long_running_inference_requests.yml | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index c3a18bb8754..2a48c920127 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -20,7 +20,7 @@ search: |- "*lookup*", "*network*", "*no such host*", - "*refused*" + "*refused*", "*timeout*", "*unreachable*" ) diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml index 00dcc0d04d1..f7a3853554f 100644 --- a/detections/application/ollama_long_running_inference_requests.yml +++ b/detections/application/ollama_long_running_inference_requests.yml @@ -15,13 +15,14 @@ search: |- `ollama_server` "[GIN]" - | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?(?:\d+m)?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" | eval src=coalesce(src, trim(raw_src)) | eval uri_path=coalesce(uri_path, raw_path) | eval http_method=coalesce(http_method, raw_method) | eval http_response_code=coalesce(http_response_code, raw_status) - | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + | rex field=raw_latency "^(?:(?\d+)m)?(?[\d\.]+)(?µs|ms|s)$" + | eval response_time_ms=coalesce(response_time_ms, (coalesce(tonumber(raw_latency_minutes), 0) * 60000) + (tonumber(raw_latency_value) * case(raw_latency_unit="µs", 0.001, raw_latency_unit="ms", 1, raw_latency_unit="s", 1000))) | where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000