Azure CLI Enumeration of Role Assignments and Container Registries
This rule monitors for the execution of Azure CLI commands used to enumerate role assignments and Azure Container Registry (ACR) details. Adversaries often perform this reconnaissance to identify high-privilege accounts, discover container registries, or map out permissions to facilitate lateral movement or persistence within an Azure environment.
Sigma
