{
    "platform": "windows",
    "queries": {
	"meterpreter": {
	    "query": "SELECT * FROM process_open_sockets WHERE remote_port = 4444;",
	    "interval": "259200",
	    "version": "3.30",
	    "description": "Default Meterpreter port",
	    "value": "Default remote Meterpreter port"
	},
	"metasploit_service" : {
	    "query": "SELECT * FROM services WHERE LENGTH(display_name) = 16 AND path LIKE '%powershell%';",
	    "interval": "259200",
	    "version": "3.30",
	    "description": "Metasploit 16 character service names"
	}
    }
}