Detects unauthorized listing of Kubernetes Secrets by a non-local client in AWS EKS audit logs. The rule triggers when an AWS EKS audit event shows event.action:list and aws.eks.audit.objectRef.resource:secrets, with a requestURI targeting cluster-wide secrets or namespace-scoped lists under kube-system or default (e.g., /api/v1/secrets, /api/v1/secrets?limit*, /api/v1/namespaces/kube-system/secrets, /api/v1/namespaces/default/secrets with limit). It filters out localhost sources and known service accounts to reduce noise. This helps identify broad secret enumeration attempts from remote clients prior to credential access activities. The rule relies on AWS EKS audit logs ingested via the AWS integration (aws.eks_audit).