> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches.md).

# CrowdStrike Searches

- [Files Written to Startup Folder](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/files-written-to-startup-folder.md)
- [Files Written to Startup Folder from the Internet](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/files-written-to-startup-folder-from-the-internet.md)
- [Local Account Creation/Deletion](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/local-account-creation-deletion.md)
- [Azure Account Creation/Deletion](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/azure-account-creation-deletion.md)
- [Scheduled Tasks](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/scheduled-tasks.md)