I am trying to add TokenElevationType as an additional filter for 1937 and 1938 to my XML Query. My script is currently.
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security"> *[System[(EventID=4688)] and EventData[Data[@Name='NewProcessName'] and (Data='C:\Windows\System32\cmd.exe')]]
</Select>
</Query>
</QueryList>
How can I add TokenElevationType as a filter?