This rule detects attempts to create or modify a Kubernetes Service of type NodePort by monitoring AWS EKS control-plane audit logs. NodePort exposes a port on every worker node, allowing external traffic to reach services/pods and potentially bypassing cluster firewalls or load balancers. The detection focuses on EKS audit records ingested via the AWS integration (logs-aws.eks_audit-*), looking for: (1) the audit object referencing services, (2) verbs create, update, or patch, (3) the requested object specifying spec.type as NodePort, and (4) an authorization decision of allow. When these conditions are met, the rule flags potential exposure of internal services to the internet, indicating a possible misconfiguration or malicious intent. The rule maps to MITRE ATT&CK techniques External Remote Services (T1133) and, depending on interpretation, Initial Access (TA0001) or Persistence (TA0003). Operational context: The rule relies on AWS EKS audit logs normalized under aws.eks.audit.* and the data stream data_stream.dataset: aws.eks_audit. It requires enabling the EKS control-plane audit log type and routing CloudWatch logs through the AWS integration. Alerts should be evaluated for legitimate use cases (e.g., temporary or namespace-scoped NodePort deployments) and supplemented with triage steps to verify necessity, ownership, and exposure risk. The rule serves as a safeguard against unintended external exposure and helps detect configurations that widen the cluster’s attack surface. Triage guidance includes identifying the affected service, validating whether NodePort is justified, auditing the user or service account responsible, assessing network path implications, and reviewing associated firewall and security controls. Remediation involves removing or constraining the NodePort exposure, revoking unauthorized access, and implementing stricter controls or approvals for NodePort usage, along with enhanced monitoring to prevent future unauthorized NodePort creations or modifications.