Files Written to Startup Folder

event_platform=win
| search event_simpleName IN ("*Written*")
| search ComputerName="*" ```Change this to search for a specific host```
| search FilePath="*\\Start Menu\\Programs\\Startup*" 
| table _time, event_simpleName, aid, ComputerName, FileName, FilePath