What alternative method does the article offer for querying Security logs besides EventLogSession, and how does it work?

The article describes using [WMI](/news/penetration-basics-obtaining-domain-user-login-information#0x03-implementation-via-wmi) via `wbemtest` or the `wmic` command to filter Event ID 4624 logs. For example, `Select * from Win32_NTLogEvent Where Logfile = 'Security' AND EventCode = 4624`. This method also supports filtering by record number and can be automated in scripts, though it requires administrative privileges.