This rule detects AWS EKS privileged pod creation by monitoring Kubernetes audit events ingested via the AWS integration (data stream logs-aws.eks_audit-*). It flags pod creation events where a container’s securityContext.privileged setting is true and the Kubernetes audit decision is "allow". To reduce noise, it excludes known safe images via a long exclusion list. A privileged pod can access host resources and break container isolation, enabling potential host compromise, persistence, lateral movement, or a C2 channel. The rule maps to MITRE ATT&CK techniques Deploy Container (T1610) and Escape to Host (T1611). It relies on enabling EKS control-plane audit logs and ensuring they are ingested with data_stream.dataset: aws.eks_audit. The alert is rated medium with a risk score of 47. False positives can arise from legitimate uses in testing or privileged tooling; these should be mitigated by exclusions and proper approvals. Investigation steps include verifying the user/service account, examining the image used (aws.eks.audit.requestObject.spec.containers.image), checking the pod namespace and resource, and looking for follow-on suspicious activity. Remediation focuses on isolating the affected node, terminating the privileged pod, auditing access, rotating credentials, patching, and tightening network controls to limit lateral movement.