This rule detects attempts to create or modify Kubernetes pods that use the host network (HostNetwork) in AWS EKS. By enabling HostNetwork, a pod shares the node’s network namespace, allowing potential eavesdropping on localhost services or bypassing namespace-level network policies. The detector watches AWS EKS audit logs (dataset aws.eks_audit) ingested via the AWS integration and triggers when a pod is created, patched, or updated with hostNetwork set to true. It filters out known benign activities by excluding certain container images and namespaces, reducing noise from legitimate debugging, platform components, or monitoring agents. The rule is mapped to privilege escalation and container deployment techniques, reflecting attacker objectives to gain broader host access and persist beyond the pod. The provided triage guidance covers log review, image/namespace validation, RBAC checks, and remediation steps, aiming to determine legitimacy and mitigate risk. It also highlights the necessity of evaluating whether HostNetwork is truly required for the pod and whether alternatives exist to reduce exposure. False positives are acknowledged for privileged debugging pods, system components with legitimate HostNetwork use, and environment-specific testing, with suggested exceptions for trusted images and namespaces. The detection leverages a KQL query over the aws.eks_audit data stream to identify events where aws.eks.audit.verb is create/patch/update with aws.eks.audit.requestObject.spec.hostNetwork:true and applies exclusions for a curated set of images and namespaces. MITRE ATT&CK mappings include T1611 (Escape to Host) under Privilege Escalation and T1610 (Deploy Container) under Execution, reflecting the dual risk of accessing host resources and deploying containers with elevated access. Operational setup notes emphasize enabling the EKS control-plane audit logs and routing them through the AWS integration to ensure data streams match data_stream.dataset: aws.eks_audit and cloud.provider: aws before activating the rule.