Detects attempts to create or modify a pod that uses the host PID namespace in AWS EKS audit logs. HostPID exposure allows a pod to see host processes and, when combined with privileged containers or ptrace, can enable privilege escalation and potential escape to the host. The rule flags create/update/patch actions on pods (aws.eks.audit.objectRef.resource:"pods" with verbs create/update/patch) where hostPID is true (aws.eks.audit.requestObject.spec.hostPID:true) and the action was allowed (aws.eks.audit.annotations.authorization_k8s_io/decision:"allow"). It excludes known safe images via a not condition on aws.eks.audit.requestObject.spec.containers.image to reduce noise. This detection relies on the AWS EKS audit data stream (aws.eks_audit) from the AWS integration and maps to MITRE ATT&CK techniques T1611 (Escape to Host) and T1610 (Deploy Container) under privilege escalation and execution. The rule has a medium severity with a risk score of 47 and is designed to help identify potential pod-level privilege escalation in Kubernetes clusters running on AWS. It requires enabling EKS control-plane audit logs and normalizing events in the aws.eks_audit data stream before activation. References and the included triage guidance provide investigation steps, false-positive considerations, and remediation actions to contain and remediate suspected misuse of HostPID in pods.