This rule detects potential impersonation of privileged Kubernetes identities within Google Cloud Platform (GCP) Audit logs for Google Kubernetes Engine (GKE). It looks for API requests where a caller attempts to act as a highly privileged cluster identity (such as system:kube-controller-manager, system:admin, system:anonymous, or kube-system service accounts) via user impersonation. Privileged identities grant broad access, including secrets visibility, token minting for service accounts, pod scheduling across nodes, and RBAC modification. The detection uses Cloud Audit data (gcp.audit) and focuses on authenticationInfo.authority_selector to identify impersonation, while cross-referencing the real actor via client.user.email, source IP, and user_agent.original. The query requires a successful event and matches authority_selector values that indicate impersonation of privileged roles, while excluding obvious legitimate impersonation callers from the client.user.email field to reduce noise. The rule is designed as a triage signal, prompting investigators to validate whether impersonation is authorized for the principal and target identity and to correlate with related activity (secrets access, TokenRequests, RBAC changes, CSR approvals). If impersonation is not authorized, it indicates a cluster-wide credential risk requiring immediate remediation, such as revoking impersonation rights, rotating credentials, or tightening RBAC. The rule maps to MITRE ATT&CK techniques for Privilege Escalation and Defense Evasion (Token Manipulation) and provides an investigation guide, remediation steps, and references to Kubernetes user impersonation concepts. Potential false positives include approved admin workflows or security tooling that legitimately uses impersonation against privileged targets; these should be whitelisted after review.