Swarm Desktop loader fetching code from frameworkmetrics or loader paths
Detects network activity from Swarm/Bee Desktop (Electron-based applications) contacting the frameworkmetrics domain or fetching specific loader URI paths such as /v1/electron or /v1/assets/, with a baseline exclusion for previously contacted remote URLs over a 30-day window.
Microsoft Sentinel (KQL)

