This is a live document containing search filters I have found at least slightly reliable to find infrastructure.
http.title:'Directory listing for' http.html:ps1
http.title:'Directory listing for' http.html:cs4.4
http.title:'Directory listing for' http.html:cobaltstrike
http.title:'Directory listing for' http.html:log4shell
http.title:'Directory listing for' http.html:cve-2022
"http.html:'files have been encrypted'"
http.title:stealer http.html:login