Detects a sequence where a principal creates or updates a Role/ClusterRole to include high-risk permissions (e.g., wildcard resources or escalation verbs such as bind, impersonate, escalate) and then creates or patches a workload resource (DaemonSet, Deployment, CronJob) within a short window, indicating RBAC-based privilege escalation followed by payload deployment. The rule relies on AWS EKS control-plane audit logs ingested via the aws.eks_audit dataset to correlate RBAC changes with subsequent workload mutations. It filters out noise (e.g., system:masters or controller status writes) to focus on non-trusted principals and escalation activity. MITRE ATT&CK mappings include Privilege Escalation (TA0004) with T1098.006 Additional Container Cluster Roles and Persistence (TA0003). The setup instructions require enabling EKS control-plane audit logging and routing logs through the AWS integration so the dataset aws.eks_audit is available for detection.