ACR Task created/modified with managed identity to exfiltrate Key Vault secret
This rule monitors for successful Azure Container Registry task write, run, or action operations that involve references to identity configurations, Azure KeyVault (vault.azure.net), or ACR task YAML files. These keywords are often associated with the configuration of managed identities or secret retrieval within the build process, which may indicate unauthorized task creation or manipulation to escalate privileges or exfiltrate secrets.
Microsoft Sentinel (KQL)
