Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when a user creates a custom task extension in Microsoft Entra Identity Governance.

Strategy

This rule monitors Microsoft Entra ID audit logs for the @ocsf.metadata.event_code value Create custom task extension. Custom task extensions in Identity Governance Lifecycle Workflows invoke Logic Apps as part of access-package and lifecycle-workflow tasks. Because these extensions execute automatically and unattended once configured, an attacker with sufficient administrative rights could register one to establish low-visibility persistence.

Triage and response

• Determine if {{@ocsf.actor.user.uid}} should have permissions to create custom task extensions in Identity Governance.
• Identify the Logic App and workflow task associated with the newly created custom task extension, and review what actions it is configured to perform.
• Check whether the associated Logic App was recently created or modified, and review its connectors and credentials for signs of tampering.
• If the custom task extension was not authorized, disable or delete it, review the Logic App run history for unauthorized executions, and begin your organization’s Incident Response (IR) process.