Detects Kubernetes service accounts performing write operations on RBAC resources (Roles, RoleBindings, ClusterRoles, ClusterRoleBindings) using EKS audit logs ingested by the AWS integration (aws.eks_audit). Service accounts typically do not manage RBAC; such activity can indicate token abuse, misconfiguration, or unauthorized privilege escalation across the cluster. The detection targets write verbs (create, delete, patch, update) on RBAC objects invoked by non-system service accounts, excluding a couple of known kube-system service accounts to reduce noise. The rule correlates the activity with the aws.eks_audit data stream and maps to MITRE ATT&CK techniques T1098 (Account Manipulation) and subtechnique T1098.006 (Additional Container Cluster Roles), aligned with the tactics Privilege Escalation (TA0004) and Persistence (TA0003). This supports investigation of potential token theft, privilege abuse, and misconfigurations that could grant persistent or elevated access across the cluster. The included triage guidance, false positive notes, and remediation steps help responders determine legitimacy, revert unauthorized RBAC changes, rotate credentials, and harden RBAC governance going forward.