Detects Azure AKS Pod Exec sessions that resemble reverse-shell or bind-shell activity by reconstructing the executed command from the URL-encoded requestURI in kube-audit events surfaced under the azure.platformlogs data stream. The rule matches a broad set of shell and network-based indicators (e.g., /dev/tcp, /dev/udp, interactive shell invocations, netcat/ncat, socat, mkfifo/mknod pipelines, and interpreter-based one-liners) and only alerts on established sessions (ResponseComplete with HTTP code 101), excluding denied attempts and duplicate audit records. It then records the decoded command (executed_command) for investigation and provides analyst guidance for correlation with identity, source IPs, and workload context. The rule maps to MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter), T1609 (Container Administration Command), and T1095 (Non-Application Layer Protocol) under the Execution and Command-and-Control tactics, aligning with post-exploitation activity in AKS environments.