Detects successful Google Kubernetes Engine (GKE) API requests originating from anonymous identities (system:anonymous or system:unauthenticated) when the client presents an unusual user agent. The rule inspects GCP audit logs (logs-gcp.audit-*) for events where service.name is k8s.io, event.outcome is success, and the client.user.email is either anonymous or not defined. It excludes common kube-probe health checks by filtering on user_agent.original to be unusual and explicitly excluding agents that indicate Kubernetes probes (e.g., kube-probe or Kubernetes formats) and health endpoints such as healthz, livez, readyz, version, or .well-known. A match indicates a potentially exposed API server or overly permissive RBAC allowing anonymous access, which can enable Initial Access (MITRE ATT&CK T1078, T1078.001). The rule is intended to highlight misconfigurations around anonymous authentication and to prompt investigation into whether the API server is Internet-exposed or intentionally permitting anonymous access. Triage guidance includes reviewing client.user.email, event.action, gcp.audit.resource_name, source.ip, and user_agent.original; validating whether anonymous authentication should be enabled; and looking for follow-on anonymous activity (e.g., pod mutations, secret reads, RBAC changes) from the same source. False positives may arise from custom health endpoints; add environment-specific exceptions after review. The rule maps to Initial Access in MITRE ATT&CK.