Detects a user attempting to establish a shell session into a Kubernetes pod via the exec subresource, as recorded in AWS EKS audit logs. The rule watches the aws.eks_audit data stream for events where an allowed authorization decision (authorization_k8s_io/decision == allow) involves the exec subresource on a pod, with verbs like create or get, and the audit stage indicates a request has started or completed. It includes nuanced exclusions to reduce noise from legitimate admin or maintenance activity (e.g., certain namespaces and known tooling scenarios). The detection maps to MITRE ATT&CK technique T1609 (Container Administration Command) under Execution (TA0002). The rule is designed for the AWS EKS integration, and its setup notes require enabling EKS control-plane audit logs and validating dataset data_stream.dataset: aws.eks_audit alongside cloud.provider: aws. The rule has a medium risk score and is intended to alert security teams to potentially unauthorized shell access into pods, enabling rapid triage and containment actions.