This rule detects read access to Kubernetes Secrets (get/list) in AWS EKS audit logs when the client fingerprint in user_agent.original matches a curated set of non-standard or attacker-leaning patterns (for example curl, wget, Python, Go-http, Kali Linux markers, or other scripting runtimes). It fires when a secrets object is read (event.action in get or list) with a successful outcome, and when source.ip is populated. The data stream used is aws.eks_audit, reflecting AWS EKS control-plane audit events. The rule targets potential credential access where the client appears atypical for routine Kubernetes traffic (in-cluster controllers or kubectl). It maps to MITRE ATT&CK technique T1552.007 (Container API) under Credential Access. Triaging guidance includes linking to human or service identities, inspecting aws.eks.audit.objectRef.namespace/name for high-value objects, correlating source IP with network activity, and checking authorization decisions. False positives may arise from CI/CD pipelines, GitOps automation, or ad hoc scripts; these should be baselined and allowlisted as appropriate. Remediation focuses on credential rotation, tightening RBAC, and network isolation for unauthorized hosts.