This rule detects attempts to abuse the GKE API server’s nodes/proxy subresource to reach a node’s Kubelet via the API server. Access to nodes/proxy allows a principal with the permission to call the Kubelet API without direct node network access or Kubelet TLS certificates, enabling potential pod spec enumeration (including environment secrets), Kubelet configuration reads, container log access, and retrieval of running pod metadata on the target node. The rule filters GCP audit logs for proxy-related actions while excluding common observability endpoints (metrics, healthz, stats/summary) to reduce noise. It maps to MITRE ATT&CK techniques for Privilege Escalation (T1611 Escape to Host), Lateral Movement (T1550.001 Use Alternate Authentication Material via Application Access Token), and Discovery (T1613 Container and Resource Discovery). The setup requires the GCP Fleet integration with GKE audit logs enabled. Detection is triggered by event.action values io.k8s.core.v1.nodes.proxy.get or io.k8s.core.v1.nodes.proxy.create and a data source limited to GCP audit logs, excluding known benign paths. The rule emphasizes non-system identities and can indicate high-risk activity such as credential exposure, commands execution in containers, and broad node discovery, warranting rapid triage and containment if unauthorized. The risk score is moderate (47) and the severity is medium, reflecting potential but not guaranteed compromise depending on RBAC posture and timestamped activity.