<QueryList>
<Query Id="0" Path="Microsoft-Windows-Winlogon/Diagnostic">
<Select Path="Microsoft-Windows-Winlogon/Diagnostic">*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and (Level=4 or Level=0) and Task = 1102 and (EventID=7002)]]</Select>
<Select Path="Microsoft-Windows-Winlogon/Operational">*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and (Level=4 or Level=0) and Task = 1102 and (EventID=7002)]]</Select>
<Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and (Level=4 or Level=0) and Task = 1102 and (EventID=7002)]]</Select>
</Query>
</QueryList>