<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">* [EventData[Data[@Name='subjectUsername']='ИмяПользователя']]
and
TimeCreated[@SystemTime>='2022-11-23T17:00:00.000Z' and @SystemTime<='2022-11-23T17:35:00.999Z']]]</Select>
</Query>
</QueryList>