Detects AWS EKS API requests where the actor impersonates a privileged cluster identity (e.g., system:kube-controller-manager, system:admin, system:anonymous, or a member of system:masters). Privileged identities have broad cluster-wide permissions, including access to all secrets, token minting for service accounts, pod scheduling, and RBAC policy modification. The rule analyzes aws.eks.audit.impersonatedUser.username and aws.eks.audit.impersonatedUser.groups against the real actor (user.name, groups, source.ip, user_agent.original) to identify impersonation attempts. It requires the request to originate from privileged channels but not from excluded control-plane components or known AWS service roles, and it verifies that the authorization decision is allow. It also constrains the operation by verb (create, delete, get, list, patch, update) and excludes common non-target identities (eks-event-service, eks:*, system:* nodes, certain IAM roles). When impersonation is detected, the rule maps to MITRE ATT&CK techniques (T1134: Access Token Manipulation; Privilege Escalation and Defense Evasion) and raises a high-severity alert. The rule relies on the AWS EKS audit data stream (aws.eks_audit) ingested via the AWS integration and expects data_stream.dataset: aws.eks_audit and cloud.provider: aws. Triage guidance covers validating the real actor versus impersonated identity, reviewing RBAC impersonation rights, inspecting related token/secret activity, and correlating with adjacent RBAC or CSR actions. False positives may arise from break-glass/admin tooling, security scanners, or approved controllers that legitimately use impersonation; remediation includes tightening impersonation permissions, rotating credentials, and applying scoped exceptions if needed. The rule supports incident response workflows for potential lateral movement or privileged access abuse in EKS clusters.