ACI container 'fortress' deployed from compromised ACR image mongo:latest
Detects the successful creation or update of an Azure Container Instance labeled with 'fortress' that utilizes a MongoDB image from a specific internal container registry.
Microsoft Sentinel (KQL)
