Techniques
Sample rules
Ollama Possible Memory Exhaustion Resource Abuse
- source: splunk
- technicques:
- T1499
Description
Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users.
Detection logic
`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*")
| rex field=_raw "count=(?<runner_count>\d+)"
| rex field=_raw "size\s*=\s*(?<memory_mb>[\d\.]+)\s+MiB"
| rex field=_raw "started in\s*(?<load_time>[\d\.]+)\s*seconds"
| rex field=_raw "source=(?<code_source>[^\s]+)"
| bin _time span=5m
| stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host
| where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500
| eval avg_memory=round(avg_memory, 2)
| eval max_memory=round(max_memory, 2)
| eval total_memory=round(total_memory, 2)
| eval avg_load_time=round(avg_load_time, 2)
| eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" )
| eval attack_type="Resource Exhaustion / Memory Abuse"
| sort -_time
| table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type
| `ollama_possible_memory_exhaustion_resource_abuse_filter`