Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects the creation of an Microsoft Entra Identity Governance lifecycle workflow.

Strategy

This rule monitors Entra ID audit logs for the @ocsf.metadata.event_code Create workflow under the WorkflowManagement audit category. Lifecycle workflows in Entra ID Identity Governance automate identity lifecycle actions such as adding a user to a group, or enabling a user account. Because these workflows execute automatically and can be scoped to specific users or groups, they can establish a durable, low-touch persistence mechanism.

Triage and response

• Determine whether {{@ocsf.actor.user.uid}} has a legitimate business reason to create lifecycle workflows.
• Review the specific workflow configuration created by {{@ocsf.actor.user.uid}} in the Entra admin center, including its trigger conditions, scope (users or groups), and the tasks it executes.
• Examine whether the workflow’s scope or tasks touch privileged groups, sensitive attributes, or credential issuance such as TAP generation.
• Check whether {{@ocsf.actor.user.uid}}’s account shows other signs of compromise, such as recent suspicious sign-ins, MFA changes, or new role assignments, prior to this activity.
• Identify any other actors who subsequently modify or reuse the workflow created by {{@ocsf.actor.user.uid}} to assess the scope of potential impact.
• Confirm with the workflow owner or their manager that the workflow was intentionally created and matches an approved identity governance process.