Product
This detection identifies potential unauthorized container image pushes to AWS ECR by monitoring for 'PutImage' API calls from users not present in an established allowlist, a common indicator of supply chain or lateral movement activity.