event_platform=win
| search ComputerName="*" ```Change this to search for a specific host```
| search event_simpleName=MotwWritten
| search FilePath="*\\Start Menu\\Programs\\Startup*"
| table _time, aid, ComputerName, FileName, FilePath, ZoneIdentifier_decimal, HostUrl, ReferrerUrl