This rule detects creation or modification (patch) of sensitive Kubernetes workloads (DaemonSets, Deployments, CronJobs) that originate from an unusual combination of client identity, source IP, and user agent in AWS EKS control-plane audit logs. It leverages the aws.eks_audit data stream ingested by the AWS integration to identify allow decisions in the Kubernetes API that may reflect stolen credentials, privilege escalation, or unauthorized control of cluster workloads. The focus is on create/patch actions against DaemonSets, Deployments, or CronJobs, flagged when the request comes from an atypical user agent/source IP and user identity, suggesting potential compromise or policy-bypass attempts. MITRE ATT&CK mappings include Privilege Escalation (T1098, with T1098.006 Additional Container Cluster Roles) and Persistence (TA0003). The rule applies a conjunction of filters to catch suspicious activity while excluding known benign cases (e.g., system:masters groups or specific AWS/admin reasons), and correlates with prior activity via a history window to assess blast radius and repeat behavior. The included setup guidance emphasizes enabling EKS control-plane audit logs, normalizing events under aws.eks.audit, and validating events carry data_stream.dataset: aws.eks_audit and cloud.provider: aws before enabling the rule.