Glossary
pods/exec
The Kubernetes Pod subresource used by kubectl exec to run a command in a running container; its audit event carries the command in requestURI.
pods/exec is the subresource behind kubectl exec (and kubectl cp, which runs tar through it). A request to it opens a streaming session into a container. In the audit log it appears with objectRef.subresource: exec, verb create or get depending on client and server versions, response code 101 when the session opens, and each argument as a command= parameter in requestURI.
The session's content is not logged. Exec by a service account, into kube-system, or with commands like chroot /host deserves attention. See how to detect kubectl exec (ATT&CK T1609).