Detects forbidden requests to the Kubernetes API surface in AWS EKS when initiated by an unusual or non-standard user agent. The rule processes AWS EKS audit logs (data_stream.dataset: aws.eks_audit) after the API server returns a completion event (aws.eks.audit.stage: "ResponseComplete"), and flags events where the authorization decision (aws.eks.audit.annotations.authorization_k8s_io/decision) is set to "forbid" and the user_agent.original appears non-standard (excluding kubernetes/$Format). It uses a new_terms field focused on user_agent.original with a history window (now-7d) to surface novel or unexpected clients over time. This can indicate adversary tooling attempting to interact with the Kubernetes API to exploit misconfigurations or pursue unauthorized access, potentially blending in with legitimate traffic by spoofing user agents. The rule is scoped to AWS EKS control-plane audit logs ingested via the AWS integration and relies on enabling the EKS audit log type and exporting to logs-aws.eks_audit-* with the data_stream.dataset aws.eks_audit and cloud.provider: aws matching the rule’s setup requirements.