Detects unusual request responses in AWS EKS Kubernetes audit logs using the new_terms detection type. The rule targets data streams from AWS EKS audit logs (aws.eks_audit) and looks for anomalies in user-related fields and response annotations that occur during the ResponseComplete stage. It learns term baselines over a history window (now-10d) and flags deviations in aws.eks.audit.user.username, aws.eks.audit.annotations, and user_agent.original that may indicate unauthorized access, misconfigurations, or abuse by actors attempting to masquerade with atypical user agents. The detection logic excludes known kubelet traffic under particular conditions to reduce noise. Threat mapping ties detections to MITRE ATT&CK techniques: Initial Access (T1078), Execution (TA0002), and Defense Evasion (TA0005) through the new_terms field. The rule has a low severity and a risk score of 21, reflecting potential but often limited impact. The setup guidance instructs enabling the EKS control-plane audit logs, routing CloudWatch logs into the AWS integration, and validating data_stream.dataset and cloud.provider match before enabling the rule. The accompanying triage guide provides steps to validate unusual user agents, correlate with trusted components, examine source IPs and resource access, review recent changes, and assess risk. Remediation steps emphasize isolating affected nodes, terminating suspicious sessions, rotating credentials, reviewing permissions, and improving monitoring and future rule tuning to reduce false positives.