This rule detects when a pod or attach/execution API call in AWS EKS results in a curl or wget command targeting an HTTPS URL. It operates on Kubernetes audit logs ingested via the AWS eks_audit data stream. The detection decodes the audit requestURI, extracts and reconstructs the command from repeated query parameters into a readable Esql.executed_command string, and then flags commands that invoke curl or wget to https. To reduce noise, it applies filters to exclude common cluster health checks and well-known endpoints (e.g., healthz, JWKS/OpenID endpoints, localhost). If a decoded command contains curl or wget followed by an https URL and passes the exclusion filters, the alert fires with contextual data such as user, namespace, pod, and request details. The rule is framed against MITRE techniques T1609 (Container Administration Command) and T1105 (Ingress Tool Transfer) under Execution/Command and Control, with a high severity to prompt rapid investigation. It relies on the aws.eks_audit dataset produced by the AWS integration and is intended for environments using EKS audit logs to catch post-exploit tool retrieval or data exfiltration attempts originating from within a pod. The triage guidance emphasizes verifying the identity and permissions of the exec user, mapping the pod to workloads, reviewing related RBAC changes, and revoking compromised credentials if needed.