Detects when a Kubernetes pod in AWS EKS is created/updated/patched with a hostPath volume mounting a host filesystem path deemed sensitive. A hostPath mount can allow a compromised container to access the node's filesystem, potentially reading data from other pods or stealing credentials. The rule queries the AWS EKS audit data stream (data_stream.dataset: aws.eks_audit) for events where aws.eks.audit.annotations.authorization_k8s_io/decision is 'allow', the target resource is pods, the operation is create/update/patch, and the spec of the volumes includes hostPath.path within a list of critical mount points (e.g., '/', '/proc', '/root', '/var', '/var/run', '/etc', '/var/lib/kubelet', etc.). To reduce false positives, the rule excludes pod definitions using trusted container images (as listed in aws.eks.audit.requestObject.spec.containers.image). It maps to MITRE techniques T1611 (Escape to Host) and T1610 (Deploy Container). The rule has a medium severity and a risk_score of 47. It provides setup guidance to enable EKS control-plane audit logs and ingest them through the AWS integration into logs_aws.eks_audit, along with triage guidance, potential false positives, recommended remediation steps, and references.