Fun times this week coming up with a @runZeroInc query for the actively-exploited MOVEit SQL injection vulnerability:
runzero.com/blog/finding-movei