Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <QueryList>
- <Query Id='0'>
- <Select Path='Security'>
- *[EventData[Data[@Name='AccessMask'] and (Data='0x100081')]]
- </Select>
- </Query>
- </QueryList>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement