Local AI Tool Enumeration by Non-Interactive Process (QUIETVAULT Behavior)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•4

This rule detects the execution or file interaction of known local AI/Large Language Model tools (e.g., Ollama, LM Studio, GPT4All) when initiated by non-interactive system processes (such as services.exe, svchost.exe, or lsass.exe) or under system/network service account contexts. This behavior is indicative of unauthorized local model staging or enumeration within a compromised environment.