Container restart following recent image push/overwrite to ACR (image replacement)
Detects instances where an Azure Container Group is restarted within 30 minutes of a successful container image push to an Azure Container Registry in the same subscription. This pattern may indicate an automated or manual deployment process following a code update, which could be misused if unauthorized image pushes are occurring.
Microsoft Sentinel (KQL)
