Detects when an ephemeral (debug) container is attached to a running AKS pod using the pods/ephemeralcontainers subresource, bypassing normal pod isolation. The rule targets Azure Kubernetes Service (AKS) environments by monitoring kube-audit-like events forwarded into azure.platformlogs (event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read) and specifically the ResponseComplete stage for operations on pods’ ephemeralContainers subresource. It inspects the injected ephemeral container’s image, command, targetContainerName, and securityContext (e.g., added capabilities or privilege) to determine if a debugging container was attached in a stealthy manner. It excludes known legitimate identities (e.g., certain AKS platform/system accounts) to reduce noise, while covering workload service accounts (system:serviceaccount:*) so that a compromised in-cluster token used for attaching a debug container is not ignored. The rule flags suspicious injections (update/patch verbs) and helps correlate with the acting identity, source IPs, and the target pod. False positives are acknowledged for legitimate troubleshooting using kubectl debug, with guidance to baseline and exclude verified break-glass or platform identities after review. The provided investigation and remediation steps guide responders to identify the actor, verify container details, review RBAC, and rotate credentials as needed. The rule’s context aligns with execution-focused threat detection for Kubernetes workloads in the cloud, incorporating MITRE technique T1610 (Deploy Container) as the primary mapped technique.