This ES|QL rule detects Kubernetes pod exec sessions that attempt to access cloud instance metadata services from within a pod. It processes AWS EKS audit logs ingested via the AWS integration (logs-aws.eks_audit-*), reconstructing the executed command from the exec requestURI after URL decoding. If the decoded command references metadata endpoints (e.g., 169.254.169.254, computeMetadata/v1, metadata.google.internal, or equivalent tokens/paths such as /latest/api/token, /latest/meta-data, /latest/user-data, /v1/credentials, etc.), the alert classifies the cloud target surface (AWS_IMDS, AWS_POD_IDENTITY, GCP_METADATA, AZURE_IMDS, or UNKNOWN). It flags potential credential access attempts (Esql.is_credential_theft) based on patterns like security-credentials, /api/token, oauth2/token, service-accounts/.*/token, or /v1/credentials. The rule maps to MITRE ATT&CK techniques: T1552.005 Cloud Instance Metadata API (Credential Access) and T1609 Container Administration Command (Execution). It surfaces key metadata such as user, source IP, user agent, namespace, and pod context for investigation and correlation with cloud audit logs. The detection helps identify high-risk, credential-theft–related activity originating from containers/pods that could expose short-lived credentials to pod code, supporting rapid containment and remediation.