This rule detects API calls to create, update, or patch Kubernetes pods that originate from an anonymous identity in AWS EKS audit logs. It fires when the AWS EKS audit data stream (aws.eks_audit) contains a request to the pods resource with an anonymous user (system:anonymous or system:unauthenticated), or impersonation of such a user, or a missing/empty username. The rule filters for requests with verbs create, update, or patch and a pod object reference, and considers different audit levels (Request, ResponseComplete, Request). A match suggests potential misconfiguration (e.g., RoleBinding/ClusterRoleBinding granting pod-write access to anonymous callers) or an active attacker abusing such bindings to deploy workloads in the cluster. The triage guidance emphasizes verifying whether the request was allowed or denied, inspecting the pod spec for images, commands, privileges, and volumes, and tracing the client identity (IP and user agent) to assess if access should be permitted. It also recommends correlating with other anonymous activity and reviewing RBAC bindings that reference anonymous identities. False positives can arise from security testing or automated scanners probing anonymous access. Remediation includes quashing unauthorized activity, removing or tightening anonymous write permissions, restricting cluster endpoints, rotating tokens, and auditing surrounding activity for follow-on access.