Detects Kubernetes pod exec sessions by reconstructing the executed command text from AWS EKS audit logs (aws.eks.audit.*) and matching it against a curated collection of sensitive file and credential paths. The rule decodes the exec request URI, extracts the command, and flags reads of host- or in-cluster material such as mounted service accounts, kubelet/config areas, host credential stores, private keys and keystores, kubeconfig/config files, and environment dumps. It deliberately excludes benign resolv.conf reads to reduce noise. When a match occurs, the rule assigns an Esql.access_type label to aid rapid triage (e.g., AWS_IRSA_TOKEN, K8S_SA_TOKEN, MOUNTED_SECRET, CERTIFICATE_OR_KEY, HOST_CREDENTIALS, PROCESS_ENV_SECRETS, EMBEDDED_CONFIG_SECRET, OTHER_SENSITIVE). This helps detect interactive or scripted access that could precede lateral movement, privilege escalation, or credential theft at the node or workload boundary. The rule maps to MITRE ATT&CK techniques T1552 (Unsecured Credentials) with subtechniques for Credentials In Files and Container API, and T1609 (Container Administration Command) under Execution. It relies on the AWS integration ingesting EKS control-plane audit logs, specifically data_stream.dataset: aws.eks_audit and cloud.provider: aws, so enable audit logging on the cluster and route logs through the integration before enabling the rule.