<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='TargetUserName']='t102903']] </Select> </Query> </QueryList>
<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='LogonType']='10']] </Select> </Query> </QueryList>
<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='TargetUserName']='t102903'] and System[(EventID='4624')]] </Select> </Query> </QueryList>
<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='LogonType']='10'] and System[(EventID='4624')]] </Select> </Query> </QueryList>
<QueryList> <Query Id="0"> <Select Path="Security">*[System[(EventID=’4663′)]]</Select> <Select Path="Application">*[System[(EventID=’1704′)]]</Select> </Query> </QueryList>
<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='TargetUserName']='user@UPN'] and System[(EventID='4769')]] </Select> </Query> </QueryList>