This rule detects create, update, or patch actions on Kubernetes pods that are performed by an unauthenticated or anonymous GKE identity, signaling a critical misconfiguration that attackers often abuse to deploy workloads or maintain access. It analyzes Google Cloud Platform (GCP) audit logs (data_stream:gcp.audit) to identify events where service.name is k8s.io and client.user.email is system:anonymous, system:unauthenticated, or is missing, and the event.action corresponds to pod creation, patch, or update (io.k8s.core.v1.pods.create/patch/update). A high-severity finding is produced when anonymous pod mutations occur, as this indicates the API server is accepting unauthenticated workload changes. The rule is aligned with MITRE ATT&CK: Deployment (T1610) under Execution (TA0002). It requires the GCP Fleet integration with GKE audit logs to be enabled. The investigation guidance emphasizes validating client.user.email, event.action, event.outcome, orchestrator.resource.name, orchestrator.namespace, and source.ip; inspecting pod image, command, and volume mounts for credential theft or reverse shells; and removing anonymous RBAC grants if present. False positives are considered essentially none in production; if observed during expected automation, it likely indicates misconfiguration and should be remediated rather than excluded. The rule includes references and an investigation field set for quick triage. Overall, this rule helps detect unauthorized or anonymous pod mutations that could be used to deploy malicious workloads or backdoors in a GKE environment.