This rule detects a request to attach a controller-type service account to a pod running in the kube-system namespace, as observed in AWS EKS control-plane audit logs. Controller service accounts in kube-system have admin-like privileges, and assigning one to a pod can enable privilege escalation and potential takeover of the cluster if an attacker can create or modify pods or their controllers. The detection relies on the AWS EKS audit data stream (data_stream.dataset: aws.eks_audit) and flags create events for pods in kube-system where the serviceAccountName contains the string "controller" while excluding known legitimate images (via an image filter list) to reduce false positives. The rule inspects aws.eks.audit.verb (create), aws.eks.audit.objectRef.namespace (kube-system), and aws.eks.audit.requestObject.spec.serviceAccountName (containing