Detects unauthorized or unauthenticated access attempts to an AWS EKS cluster that are being allowed by the API server, indicated by anonymous user credentials or impersonation, and an unusual user agent. The rule analyzes EKS audit logs ingested from the AWS integration (data_stream.dataset: aws.eks_audit) and triggers when an audit event shows authorization as 'allow' (aws.eks.audit.annotations.authorization_k8s_io/decision:"allow") while the requesting user is 'system:anonymous' or 'system:unauthenticated' (or impersonatedUser.username variants). It additionally filters out benign health/version endpoints (e.g., /healthz, /livez, /readyz, /version) and requires a non-default user_agent.original to indicate an unusual/opaque client. The detection targets logs under logs-aws.eks_audit-* and uses Kuery to match the dataset, user fields, and excluded endpoints. It maps to MITRE ATT&CK Initial Access (T1078; Default Accounts T1078.001) with a medium severity and is categorized as a new_terms rule that flags potential abuse of anonymous access for initial access to the cluster. The rule includes setup guidance to enable EKS control-plane audit logs and verify correct data fields before enabling the detection. The objective is to surface legitimate misconfigurations and potential attacker activity that leverages anonymous access for unauthorized actions in the Kubernetes API server, enabling rapid investigation and containment.