How do I add TokenElevationType 1937 and 1938 to my Event Viewer XML Query?

19 Views Asked by At

I am trying to add TokenElevationType as an additional filter for 1937 and 1938 to my XML Query. My script is currently.

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security"> *[System[(EventID=4688)] and EventData[Data[@Name='NewProcessName'] and (Data='C:\Windows\System32\cmd.exe')]]
    </Select>
  </Query>
</QueryList>

How can I add TokenElevationType as a filter?

0

There are 0 best solutions below