<QueryList>
   <Query Id="0" Path="Security">
     <Select Path="Security">
      *[System[(EventID='4624')]
      and
      EventData[Data[@Name='TargetUserName']='My_BadAcct']
      ]
     </Select>
   </Query>
 </QueryList>