Docker Pull from ACR and Repository Enumeration for Offline Recon
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
Sigma
