# Detection Exception for Lenovo Temp Account Creation

**URL:** <https://discuss.elastic.co/t/detection-exception-for-lenovo-temp-account-creation/364621>\
**Category:** SIEM\
**Created:** [August 8, 2024, 5:51pm UTC](https://discuss.elastic.co/t/detection-exception-for-lenovo-temp-account-creation/364621 "2024-08-08T17:51:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\
**Post date:** [August 8, 2024, 5:51pm UTC](https://discuss.elastic.co/t/detection-exception-for-lenovo-temp-account-creation/364621/1 "2024-08-08T17:51:56Z")

</div>

I have a series of 4 events being generated when the Lenovo Update application runs on a Windows computer.

1. Create account lenovo\_tmp\_####$$$$ (eventID 4720)
2. Enable account lenovo\_tmp\_####$$$$ (eventID 4722)
3. Add lenovo\_tmp\_####$$$$ to local administrators group (eventID 4732)
4. Delete lenovo\_tmp\_####$$$$ (eventID 4726)

The 3rd event generates an alert in Kibana under the rule "User Added to Privileged Group". This is a correct rule application, but since this is a known process, I would like to filter out these events

Events 1, 2, and 4 contain both the account name and the random SID generated by the process. Event 3, which generates the alert, only contains the random SID. I could filter on the name match for lenovo\_tmp\_\*, but that information isn't included in the triggering event.

The time between event 1 and event 3 can be as little as .03 seconds. And this process can happen multiple times per day per machine. I am generating several hundred alerts per day through this process.

I am running cloud Kibana with current stack. Windows events are being sent via subscription to a single server and winlogbeats 8 is running on the server to transfer the log files.

We don't have the option of replacing all the Lenovo devices.

How can I apply a rule exception to this event when the SID is random and there's no other relevant information included in the event to filter on?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2024, 5:52pm UTC](https://discuss.elastic.co/t/detection-exception-for-lenovo-temp-account-creation/364621/2 "2024-09-05T17:52:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.