Detects non system identities using the AWS EKS API server nodes proxy to reach a worker node Kubelet via the nodes proxy subresource. The rule consumes aws.eks_audit logs and matches aws.eks.audit.objectRef.subresource: proxy and aws.eks.audit.objectRef.resource: nodes. It excludes requests to observability endpoints such as /metrics, /healthz and /stats to reduce noise from legitimate monitoring. A match indicates a principal with nodes proxy RBAC permission accessed the Kubelet proxy and could enumerate pod specs (including environment variable secrets), read Kubelet configuration and PKI material, and retrieve container logs and pod metadata across workloads on that node. It can enable privilege escalation and lateral movement and discovery within the cluster. The rule maps to MITRE ATT&CK techniques Escape to Host, Use Alternate Authentication Material and Container and Resource Discovery. Investigations should review the RBAC binding granting nodes proxy, examine TokenRequest API usage that minted credentials, and check for access across multiple nodes in a short window. If suspicious, isolate affected nodes, rotate credentials and API keys, and audit cluster permissions to ensure nodes proxy is restricted to infrastructure automation only.