windows_persistence-startup_items.conf

{
  "platform": "windows",
  "description": "ATT&CK: T1060",
  "queries": {
    "Startup_Items": {
        "query": "select * from startup_items;",
        "interval": 3600,
        "description": "Windows Startup Items Osquery predefined query - ATT&CK T1060",
        "removed": false
        },
    "Snaphost_Startup_Items": {
        "query": "select * from startup_items;",
        "interval": 28800,
         "description": "Snapshot Windows Startup Items Osquery predefined query - ATT&CK T1060",
         "snapshot": true
        }
   }
}