diff --git a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml  b/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml 
new file mode 100644
index 0000000000..4efb07706d
--- /dev/null
+++ b/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml 	
@@ -0,0 +1,40 @@
+name: Kubernetes AWS detect RBAC authorization by account
+id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8
+version: 1
+date: '2020-06-23'
+author: Rod Soto, Splunk
+status: deprecated
+type: Hunting
+description: This search provides information on Kubernetes RBAC authorizations by
+  accounts, this search can be modified by adding top to see both extremes of RBAC
+  by accounts occurrences
+data_source: []
+search: '`aws_cloudwatchlogs_eks` annotations.authorization.k8s.io/reason=* | table
+  sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason | stats
+  count by user.username annotations.authorization.k8s.io/reason | rare user.username
+  annotations.authorization.k8s.io/reason |`kubernetes_aws_detect_rbac_authorization_by_account_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudwatch logs
+known_false_positives: Not all RBAC Authorications are malicious. RBAC authorizations
+  can uncover malicious activity specially if sensitive Roles have been granted.
+references: []
+tags:
+  analytic_story:
+  - Kubernetes Sensitive Role Activity
+  asset_type: AWS EKS Kubernetes cluster
+  confidence: 50
+  impact: 50
+  message: tbd
+  observable:
+  - name: field
+    type: Unknown
+    role:
+    - Unknown
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 25
+  security_domain: threat
\ No newline at end of file