ACR Task Created or Modified with Attached Managed Identity Referencing Key Vault Secrets
Detects Azure CLI operations creating or modifying an Azure Container Registry (ACR) Task with an attached managed identity, where the task definition references Key Vault secrets. This pattern is used to abuse ACR Task automation and its managed identity to exfiltrate Key Vault secrets.
Sigma
