This rule detects AWS EKS pods where a container is created with dangerously permissive Linux capabilities added to its securityContext (capabilities.add). The targeted capabilities include BPF, DAC_READ_SEARCH, NET_ADMIN, SYS_ADMIN, SYS_BOOT, SYS_MODULE, SYS_PTRACE, SYS_RAWIO, and SYSLOG. Such capabilities grant elevated privileges that can facilitate container escapes, host modification, or privilege escalation within a Kubernetes cluster. The detection uses AWS EKS audit logs (data_stream.dataset: aws.eks_audit) and filters for create operations on pods where aws.eks.audit.requestObject.spec.containers.securityContext.capabilities.add contains any of the listed capabilities, requiring that the authorization decision is allow. To reduce noise, the rule excludes known legitimate cases by namespace and image (e.g., kube-system; and images in certain namespaces like datadog, kubearmor, defender, metallb-system, longhorn-system with whitelisted images). The rule supports incident response by guiding investigators to identify the principal behind the pod, review the requesting image and capabilities, and look for other escape primitives or related activity. It maps to MITRE ATT&CK techniques T1611 (Escape to Host) and T1610 (Deploy Container) across Execution, Privilege Escalation, and Defense Evasion. The rule has a medium severity with a risk_score of 47 and is designed to trigger on potentially dangerous container deployment activity within AWS EKS clusters.