Unexpected results from an XML query filter for security event log
Solution 1:
Try this:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4608)]]</Select>
<Suppress Path="Security">*[EventData[Data[@Name="TargetUserSid"] = "S-1-5-18"]]</Suppress>
</Query>
</QueryList>