Detects potential endpoint permission enumeration attempts by an anonymous (unauthenticated) user against the AWS EKS Kubernetes API server. The rule analyzes AWS EKS audit logs ingested from the AWS integration (data_stream.aws.eks_audit) to identify bursts of requests from an unauthenticated identity probing many distinct endpoints/resources with a small document set and mixed 401/403/404 responses. It normalizes audit records (aws.eks.audit.*) and classifies outcomes (authz_allow, authz_forbid, authn_authz_failed, success, not_found) to surface suspicious discovery/reconnaissance activity. When a source IP and user agent generate >5 distinct request URIs and >3 distinct resources within a short window, with limited documents and at least one forbidden/unauthorized/not_found outcome, the rule triggers and surfaces context for investigation. The pattern is consistent with reconnaissance techniques such as container/resource discovery (T1613) and active scanning (T1595) under the Reconnaissance/Discovery umbrella. The rule also provides triage guidance, false positives analysis (e.g., transient anonymous auth configurations or health checks), and remediation steps (disable anonymous access, restrict API exposure, rotate compromised credentials, enforce least-privilege RBAC, retain audit logs, and monitor for follow-on authenticated activity). It has been designed for AWS EKS environments and relies on the AWS integration to feed the aws.eks_audit dataset, enabling detection across multiple endpoints and resource types from a single source IP.