An account failed to log on.

Subject:
	Security ID:		SYSTEM
	Account Name:		****$
	Account Domain:		*****
	Logon ID:		0x3e7

Logon Type:			10

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		v.pupkin
	Account Domain:		****

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:
	Caller Process ID:	0x14f0
	Caller Process Name:	C:\Windows\System32\winlogon.exe

.....

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security"> 
                 *[EventData[Data[@Name='SubjectUserName'] and (Data='v.pupkin')]] 
                 and 
                 *[System[(EventID='4625')]] 
               </Select>
  </Query>
</QueryList>