Microsoft.ContainerRegistry/registries/listCredentials/action

Azure

Microsoft.ContainerRegistry/registries/listCredentials/action

service: Azure - Container Registry

tactics:

Credential Access Discovery

techniques:

T1552 T1526

tags:

Azure Container Registry

Event

Lists the admin credentials for an Azure Container Registry, exposing the username and password for registry access.

Security Context

Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud calls listCredentials on the production registry acroccamy.azurecr.io to harvest the admin account’s password. With the credentials, Draco can push a backdoored image (e.g., occamy-pipeline:latest) into the registry; the next time AKS pulls that tag, the backdoor lands in the cluster. Maps to T1552 + supply-chain implications.

{
  "authorization": {
    "action": "Microsoft.ContainerRegistry/registries/listCredentials/action",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ContainerRegistry/registries/acroccamy"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010111000",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010111001",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T22:42:18.7172938Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ContainerRegistry/registries/acroccamy/events/90000000-0000-4000-8000-000010111001/ticks/638798283387172938",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010111010",
  "operationName": {
    "value": "Microsoft.ContainerRegistry/registries/listCredentials/action",
    "localizedValue": "List Container Registry credentials"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.ContainerRegistry",
    "localizedValue": "Microsoft Container Registry"
  },
  "resourceType": {
    "value": "Microsoft.ContainerRegistry/registries",
    "localizedValue": "Microsoft.ContainerRegistry/registries"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ContainerRegistry/registries/acroccamy",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T22:42:19.0218732Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ContainerRegistry/registries/acroccamy",
    "message": "Microsoft.ContainerRegistry/registries/listCredentials/action",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010111011",
    "clientIpAddress": "203.0.113.66",
    "method": "POST",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ContainerRegistry/registries/acroccamy/listCredentials?api-version=2023-11-01-preview"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Credential Access Discovery

Techniques:

T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...

Microsoft.ContainerRegistry/registries/listCredentials/action

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events