Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfiguration or ValidatingWebhookConfiguration objects by non-system identities in AWS EKS audit logs. The rule monitors the AWS EKS audit data stream (aws.eks_audit) for create/update/patch/delete operations on admission webhook configurations where the request is allowed (annotations.authorization_k8s_io/decision: allow) and the actor does not match common system or approved operators. Malicious or misconfigured webhooks grant attackers persistence by mutating pod specs, injecting sidecars, blocking security tooling, or exfiltrating pod data, all while the webhook configuration itself can appear benign in kubectl output. The rule filters out legitimate changes by known operators and service accounts, such as kube-controller-manager, kube-scheduler, kube-system, cert-manager, Gatekeeper, Kyverno, Flux, and others. It flags potential persistence/defense-evasion scenarios by identifying non-system actors altering webhook configurations and by examining webhook destinations and settings (e.g., clientConfig.url, clientConfig.service, failurePolicy, namespaceSelector, rules). The associated MITRE coverage includes Persistence (T1546) and Defense Evasion (T1562). False positives may arise from legitimate cluster maintenance or GitOps/controller upgrades. Recommended response includes reverting/restricting the webhook, rotating credentials, redeploying affected workloads, and reviewing outbound destinations and related RBAC changes. The rule relies on the AWS EKS audit stream (aws.eks_audit) and requires the audit control-plane log type to be enabled and ingested as data_stream.dataset: aws.eks_audit with cloud.provider: aws.