Detects suspicious AKS (Azure Kubernetes Service) activity where a service account or node identity issues self-subject access (SelfSubjectAccessReview) or self-subject rules reviews (SelfSubjectRulesReview) to enumerate its own effective permissions. Non-human identities typically do not enumerate permissions outside of known controllers; such activity can indicate stolen tokens probing RBAC before privilege escalation. The rule targets Azure Platform Logs (azure.platformlogs) derived from AKS diagnostic logs and kube-audit events, specifically the Read action (Microsoft.ContainerService/managedClusters/diagnosticLogs/Read) where a self-subject review is requested. It filters for calls from system:serviceaccount:* or system:nodes:* while excluding Azure Arc agent accounts (system:serviceaccount:azure-arc:*). The detection supports impersonation scenarios and should be baselined per environment to minimize false positives. It includes guidance to investigate identity context, correlation with privileged actions, and validation of the caller’s scope before remediation.