Glossary
nodes/proxy
The Kubernetes Node subresource that proxies requests through the API server to a node's kubelet API, which can run commands in containers.
nodes/proxy lets a caller reach a node's kubelet API through the API server (/api/v1/nodes/<node>/proxy/...). The kubelet can list pods, read container logs and run commands in containers of that node. The API server audits the nodes/proxy request, but not as a pods/exec, so exec-based detections miss it.
The Kubernetes RBAC good practices list access to the node proxy subresource as a privilege escalation risk; it should not be granted to people or ordinary workloads. See detecting kubectl exec, attach and port-forward.