Azure Container Registry Admin/Scoped Credential Retrieval
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
Sigma
