Xpath
Jump to navigation
Jump to search
Windows Event viewer uses xpath to create queries. It is retarded...
Some examples for greater good:
Code | Comment |
---|---|
<QueryList>
<Query Id="0" Pat="Security">
<Select Path="Security">
*[System[(EventID='4662')]]
and
*[EventData[Data[@Name='ObjectType'] and (Data='%{bf967a9c-0de6-11d0-a285-00aa003049e2}')]]
and
*[EventData[Data[@Name='AccessList'] and (Data='%%7684
				')]]
</Select>
</Query>
</QueryList>
|
search for 4662 (group changed) of objecttype "bf967a9c-0de6-11d0-a285-00aa003049e2" which is group and accesslist = 7684 which is members |
Example | Example |
Example | Example |
some tags to find this page: query, QueryList, eventdata, ObjectType, AccessList, Security