Powershell : filterXpath samples

• Event ID 4768 : Kerberos TGT not AES

$FilterXpath_4768_NotAES = "*[System[EventID=4768]] and *[EventData[(Data[@Name='TicketEncryptionType'] !='0x12' and Data[@Name='TicketEncryptionType'] !='0x11')]]"

• Event ID 4769 : Kerberos TGS not AES

$FilterXpath_4769_NotAES = "*[System[EventID=4769]] and *[EventData[(Data[@Name='TicketEncryptionType'] !='0x12' and Data[@Name='TicketEncryptionType'] !='0x11')]]"

• Event ID 4776 : Last 24h NTLM connections for a specific user

$FilterXpath_4776_NTLM = "Event[System[(EventID=4776) and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name='TargetUserName']='$user']]"