Malicious container image pushed with overwritten tag to ACR mongo repository

Emiliano Mema@Nosalva

•updated Jul 16, 2026•1•0•8

This rule detects 'Push', 'Put', or 'PutManifest' operations on the 'mongo' repository using specific tags ('mongofr', 'latest'), which may indicate an attempt to overwrite or inject a malicious container image into a critical database registry.