Detects denied GKE API create attempts originating from identities not belonging to the GKE control plane. Denied creates can indicate RBAC probing, stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads. The rule excludes control-plane/bootstrap identities to focus on potentially unauthorized activity. It relies on GCP audit logs (gcp.audit) with data_stream.dataset:gcp.audit, service.name:k8s.io, event.outcome:failure, event.action:*.create, and gcp.audit.status.message containing forbidden or Unauthorized, while filtering out well-known system and bootstrap accounts (e.g., system:apiserver, system:kube-*, system:cloud-controller-manager, system:gke-*, system:nodes, system:serviceaccount:kube-system:*, system:serviceaccount:gke-managed*, kubelet-bootstrap, kubelet-nodepool-bootstrap, and gcp:kube-bootstrap) and excluding user_agent.original patterns such as Kubernetes formats. The rule is mapped to MITRE ATT&CK Execution (TA0002). For triage, investigate fields like client.user.email, event.action, gcp.audit.resource_name, source.ip, user_agent.original, and gcp.audit.status.message; determine whether the identity should exist and whether the target resource is sensitive (pods, secrets, RBAC); correlate with any later successful creates or RBAC changes from the same actor.