<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*
[System
   [Provider
      [@Name='Microsoft-Windows-Security-Auditing']
      and
      TimeCreated[timediff(@SystemTime) <= 86400000]
   ]
   and EventData[Data="joe"]
]
    </Select>
  </Query>
</QueryList>