Detects when an identity minted a service account token via the AKS TokenRequest API (serviceaccounts/token) within an Azure Kubernetes Service (AKS) cluster, excluding known platform/control-plane identities. The rule analyzes Azure Platform Logs (AKS kube-audit events) to catch non-platform identities requesting tokens to impersonate workloads, move laterally, or escalate privileges. Coverage includes workload service accounts (system:serviceaccount:<ns>:<sa>), meaning a compromised in-cluster token could be minted for another service account. The detection uses a query over data_stream.azure.platformlogs, matching event.action (Microsoft.ContainerService/managedClusters/diagnosticLogs/Read), the TokenRequest subresource, verb create, and successful responses (200/201). It excludes token generation by kubelet (system:node:*) and kube-service accounts like aksService, focusing on signals from non-platform principals. Investigations typically follow by identifying the requesting identity (user.username and groups), inspecting userAgent for tooling versus custom clients, locating the target service account (objectRef.name/namespace) and its RBAC, and pivoting on source IPs to trace subsequent API calls and related RBAC or secret activity. MITRE mapping: T1528 Steal Application Access Token under Credential Access (TA0006). The rule is designed for Azure platform log ingestion, and its triage guidance emphasizes correlation with recent RBAC changes and token usage patterns to determine if token minting is authorized automation or malicious activity.