This rule detects potential reverse- or bind-shell activity initiated via kubectl exec within AWS EKS pods by analyzing Kubernetes audit logs ingested through the AWS integration (logs-aws.eks_audit-*). It URL-decodes the exec requestURI, parses the command fragment, and evaluates it against high-signal shell and socket techniques often used for post-exploitation interactive access or command-and-control within a container (e.g., /dev/tcp, /dev/udp redirections, socat, nc/ncat with -e, bash -i, pty-related patterns). Local health-check patterns (e.g., localhost/127.0.0.1 targets) are excluded to reduce noise. The rule maps to MITRE ATT&CK Execution techniques (T1059 - Command and Scripting Interpreter) and T1609 (Container Administration Command). It is scoped to the AWS EKS audit data stream and requires enabling control-plane audit logs and routing them to the AWS integration with data_stream.dataset: aws.eks_audit. The rule carries a high severity and a risk score of 73. Triage guidance covers actor identification, pod/namespace correlation, command replay in a sandbox, and investigating related activity (secret reads, exec to other workloads, RBAC changes). Remediation calls for terminating the session, isolating the workload/node, rotating credentials, and revoking pods/exec access unless strictly required.