Azure recon: ACR registry/repository enumeration paired with role assignment listing
Detects anomalous discovery behavior in Azure where a principal performs multiple 'read' operations against both Container Registry and Role Assignments within a short timeframe. This pattern is consistent with an adversary attempting to map the cloud environment, identify accessible resources, and understand permission structures.
Microsoft Sentinel (KQL)
