Detects an AKS (Azure Kubernetes Service) identity attempting an interactive exec session into a pod, i.e., a kubectl exec-like operation inside a workload. Excludes node, control-plane, and kube-system service accounts, focusing on workload/service accounts that attackers are more likely to abuse. Triggers on azure.platformlogs kube-audit events with event.action Microsoft.ContainerService/managedClusters/diagnosticLogs/Read for pods/exec, where the target resource is a pod and the verb is create or get. Provides guided investigation steps (identity, groups, target pod, exec request path, user agent, and source IP) and remediation (revoke tokens/kubeconfig, terminate sessions, inspect pod for tampering, rotate credentials, collect artifacts). Includes false-positive considerations for admin debugging and verified tooling, and suggests exclusions after review. References MITRE technique T1609 (Container Administration Command) under Execution, with related Kubernetes and AKS context.