SIEM Alert: Risk Detected about Activity User Creation and Deletion on Veeam ONE Server

[koravit]

Our SIEM system (Splunk) has detected a risk event on the Veeam ONE Server, involving the creation and subsequent deletion of a user account: Veeam_6043-4343A67F (create & delete in 1 min). This action was performed by the user xxxx (a service account). However, no one within our team is aware of this activity, and we could not locate any corresponding event logs on the OS (Windows Server 2019) or within Veeam ONE.

Could you please help us understand the following:

Is it possible that Veeam ONE itself creates and deletes such user accounts as part of its internal processes?
If so, what scenarios or mechanisms within Veeam ONE could result in this type of event?
We need to explain this situation to our Security team to ensure that this activity is not a result of unauthorized access or malicious actions. Any insights you can provide would be greatly appreciated.

Thank you for your assistance.
Case #07537821

[RomanK]

Hello Koravit,

Yes, this is a known behavior, you can find more information in this KB https://www.veeam.com/kb4042

Thanks