This ES|QL rule correlates two distinct GKE audit events from the same user within five minutes to detect RBAC-based privilege escalation followed by workload deployment. It watches Google Cloud Platform (GCP) audit logs (GKE audit dataset) and requires the GCP Fleet integration with GKE audit logging enabled. The rule flags when a single identity creates, updates, or patches a Role or ClusterRole that grants high‑risk permissions (wildcards; escalation verbs such as escalate, bind, impersonate; secret read; or privileged API resources like pods/exec and serviceaccounts/token) and, within five minutes, creates or patches a DaemonSet, Deployment, or CronJob. The detection logic computes the gap between the latest sensitive RBAC event and the earliest workload modification for that identity and time window. If the gap is five minutes or less, the rule raises an alert that an RBAC change may be followed by payload deployment, consistent with privilege escalation and persistence behavior. The rule excludes common, legitimate noise by ignoring certain system/service accounts and local sources, and it prioritizes signals from non-local clients and non-system accounts. Context is captured (event actions, touched resources, client user agent, and source IP) to aid investigation. The rule includes MITRE ATT&CK mappings to T1098 (Account Manipulation) and subtechniques related to container RBAC, with associated tactics for Privilege Escalation and Persistence. Data from the gcp.audit dataset is filtered to require non-null client.user.email and source IP, while excluding specific system accounts. False positives can arise from GitOps or platform controllers performing synchronized RBAC and workload changes, or automated maintenance windows. Recommended actions include rolling back unauthorized RBAC/workload changes, revoking credentials, tightening RBAC mutations, and cross-checking with change tickets and actor fingerprints. Deployment prerequisites include enabling GKE audit logs and capturing request bodies for RBAC resources to confirm verbs and resources in gcp.audit.request.