Azure Container Registry (ACR) Audit Logs

Location

Description

Audit and access logs for Azure Container Registry operations including image push and pull events, repository listing, token use, webhook changes, authentication failures, and registry configuration updates.

Forensic Value

ACR logs reveal supply-chain and workload-staging abuse around AKS and other containerized platforms. Unauthorized image pulls can show attacker reconnaissance of private repositories. Malicious image pushes or tag changes can explain how compromised workloads were introduced. Registry authentication failures and token use help identify abused service principals or workload identities tied to cluster operations.

Tools Required

Collection Commands

az monitor diagnostic-settings list --resource <acr-resource-id>

AzureDiagnostics | where TimeGenerated > ago(30d) | where ResourceProvider == "MICROSOFT.CONTAINERREGISTRY" | project TimeGenerated, OperationName, CallerIPAddress, identity, Repository, Tag

AzureActivity | where TimeGenerated > ago(30d) | where ResourceProvider has "Microsoft.ContainerRegistry" | project TimeGenerated, OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue

MITRE ATT&CK Techniques