ACR admin credentials retrieved via az acr credential show (listCredentials action)

Emiliano Mema@Nosalva

•updated Jul 16, 2026•1•0•2

Detects successful execution of the 'List Credentials' action on an Azure Container Registry. This action returns the administrative credentials (username and password) for the registry, which may indicate unauthorized credential access or preparation for exfiltration or lateral movement.