Skip to content

Instantly share code, notes, and snippets.

@askalee

askalee/gist:0135be344278cd721dee2cad95f93061

Created December 5, 2016 10:25
Show Gist options
  • Save askalee/0135be344278cd721dee2cad95f93061 to your computer and use it in GitHub Desktop.
Save askalee/0135be344278cd721dee2cad95f93061 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*
[System
[Provider
[@Name='Microsoft-Windows-Security-Auditing']
and
TimeCreated[timediff(@SystemTime) &lt;= 86400000]
]
and EventData[Data="joe"]
]
</Select>
</Query>
</QueryList>
@askalee
Copy link
Author

askalee commented Dec 5, 2016

test

@askalee
Copy link
Author

askalee commented Dec 5, 2016

test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment