This rule detects suspicious privilege enumeration activity in AWS EKS clusters by non-human identities (service accounts or nodes) using the selfsubjectaccessreview or selfsubjectrulesreview APIs. It monitors AWS EKS audit logs (aws.eks_audit data stream) for create calls to the selfsubjectaccessreviews or selfsubjectrulesreviews resources, where the authorization decision is documented as allowed (annotations.authorization_k8s_io/decision:"allow"). The detection targets calls initiated by system:serviceaccount:* or system:node:* users (or their impersonatedUser counterparts) and filters out common kubernetes user agents to focus on unusual or automated tooling (user_agent.original: not kubernetes/$Format). This pattern is atypical for non-human identities and may indicate an attacker or compromised token attempting to map their own privilege scope to facilitate lateral movement or further access within the cluster. The rule ties to MITRE ATT&CK Discovery techniques (T1069 — Permission Groups Discovery, including T1069.003 Cloud Groups, and T1613 — Container and Resource Discovery) to classify the activity as privilege/permission discovery within a containerized, cloud-based environment. The accompanying investigation guide covers log review, context validation, source verification, and remediation steps to confirm legitimacy and contain any potential compromise.