Detects an Azure Kubernetes Service (AKS) identity performing multi-resource discovery by listing or getting multiple distinct Kubernetes API resource types (namespaces, nodes, pods, roles, clusterroles, configmaps, serviceaccounts, rolebindings, clusterrolebindings) within a short window. The rule uses AKS kube-audit events ingested via Azure Platform Logs (azure.platformlogs) and extracts fields (stage, verb, objectRef.resource, objectRef.namespace, user.username, userAgent, sourceIPs) into Esql.* variables. It groups responses by username, user_agent, and the AKS cluster id (azure.resource.id) and triggers when the distinct resource set touched reaches a threshold (3 or more). It excludes known platform/control-plane identities and automation-tool user agents, and ignores activity in the elastic-system namespace to reduce noise. This behavior mirrors Kubernetes multi-resource discovery (MITRE ATT&CK T1613) and helps distinguish recon/orientation activity from steady-state controllers that touch a narrow set of resources. The rule is designed to be tuned via baselining and suppression to minimize false positives related to GitOps, backup, and platform operators. It provides triage data (identities, clusters, resource enumerations, and source IPs) for incident response and recommended remediation steps if unauthorized activity is detected. The detection is enabled through the Azure Fleet integration with kube-audit logs flowing into the azure.platformlogs data stream and uses Esql aggregation to surface multi-resource touch patterns by identity across a cluster.