Detects attempts to create Kubernetes resources in AWS EKS that are forbidden by policy. The rule analyzes AWS EKS control-plane audit logs ingested via the AWS integration (aws.eks.audit) for create operations (verb == create) that reach the stage 'ResponseComplete' with the authorization decision set to 'forbid'. It excludes system components (system:kube-scheduler, system:kube-controller-manager) to reduce noise. This pattern indicates an unauthorized creation attempt that could reflect an adversary seeking to manipulate cluster resources, escalate privileges, or move laterally within the Kubernetes environment. The detection is implemented as an EQL query over the logs-aws.eks_audit-* data stream and maps to MITRE ATT&CK Execution (TA0002). The rule is accompanied by an investigation guide, including key fields to inspect (aws.eks.audit.user.username, aws.eks.audit.objectRef.resource, aws.eks.audit.sourceIPs, aws.eks.audit.annotations.authorization_k8s_io/reason), RBAC and cluster role binding verification, and policy change reviews. It also provides remediation steps (cluster isolation, credential revocation, RBAC tightening, thorough log audits, and enhanced monitoring) and false-positive considerations (legitimate automated deployments, testing, and temporary permission changes).