Код:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4688</EventID> 
  <Version>1</Version> 
  <Level>0</Level> 
  <Task>13312</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8020000000000000</Keywords> 
  <TimeCreated SystemTime="2014-04-24T13:15:26.589774100Z" /> 
  <EventRecordID>6153865</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="2972" /> 
  <Channel>Security</Channel> 
  <Computer>*</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-21-661746261-1348677824-142223018-61023</Data> 
  <Data Name="SubjectUserName">*</Data> 
  <Data Name="SubjectDomainName">*</Data> 
  <Data Name="SubjectLogonId">0x32b808</Data> 
  <Data Name="NewProcessId">0x137c</Data> 
  <Data Name="NewProcessName">C:\Windows\System32\calc.exe</Data> 
  <Data Name="TokenElevationType">%%1938</Data> 
  <Data Name="ProcessId">0xeb0</Data> 
  <Data Name="CommandLine" /> 
  </EventData>
  </Event>

Код:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[EventData[Data[@Name='NewProcessName']]]</Select>
  </Query>
</QueryList>