An incident handler would use autoruns to search for all autostart extensibility points on a Windows host. Autoruns is a specialized tool designed to show which programs are configured to run during system bootup or login. It provides a comprehensive view of all the points where applications can automatically start, making it the best choice for this purpose.