Filter Events By User

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">* [EventData[Data[@Name='subjectUsername']='Tor']]</Select>
  </Query>
</QueryList>