Azure ACR Scoped Access Token Creation for Persistent Non-Admin Registry Access
Detects the creation of Azure Container Registry (ACR) scoped access tokens or scope maps. Adversaries may use these features to establish persistent, least-privileged access to registry resources, often bypassing standard authentication monitoring.
Sigma
