Scoped ACR access token created via az acr token create for persistent registry credentials

Emiliano Mema@Nosalva

•updated Jul 16, 2026•0•0•2

Detects the creation or modification of tokens for an Azure Container Registry (ACR). This activity may indicate an administrator managing registry access, or an adversary creating long-lived credentials for persistence within the container environment.