Ethersphere bee-js and Swarm Desktop Supply Chain Compromise (SleepyDuck) Hunt
Detects evidence of the Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 supply chain compromise (SleepyDuck) in Defender XDR. Matches 21 reported SHA256 hashes in file, process and network initiator telemetry, connections to api.frameworkmetrics.xyz, the eight reported hub and relay IPs, the reported webhook.site and pastebin.com paths in URLs and command lines, the ScreenConnect relay IP and service ID in command lines, persistence paths on Linux, macOS and Windows, and the rogue ScreenConnect Client service registry key. Network and process activity from the ~/.solidity implant folder is matched regardless of destination, which keeps the hunt useful after the attacker rotates the hub address through an Ethereum contract. Lookback is 30 days. Coverage depends on Defender for Endpoint telemetry per platform, and SHA256 values are not reliably populated for non-executable files such as tgz, cjs, deb and rpm packages.
Microsoft Sentinel (KQL)
