Detects modifications to the CoreDNS or kube-dns ConfigMap in the kube-system namespace by monitoring AWS EKS audit logs (data_stream.aws.eks_audit). It flags update, patch, or delete operations on the ConfigMap resource where objectRef.name is coredns and objectRef.namespace is kube-system. Changes to CoreDNS Corefile can alter DNS resolution for all pods, potentially redirecting internal service names to attacker-controlled IP addresses and enabling man-in-the-middle access to API traffic, credentials, and other sensitive data across the cluster. The rule targets rare but impactful DNS configuration changes and should trigger immediate investigation when deviations are detected. Investigations should verify actor authorization, review the ConfigMap diff for redirections or unusual forwards, and correlate with other suspicious activity; remediation includes reverting to a known-good CoreDNS configuration and tightening RBAC around kube-system DNS ConfigMaps. Note that legitimate operators may update CoreDNS settings, so validate changes against approved change windows and baselines.