Detects creation of a GKE service account token via the Kubernetes TokenRequest API initiated by a non-system identity. TokenRequest enables programmatic minting of short-lived credentials for service accounts the caller can create tokens for, without reading a filesystem token. An attacker with initial cluster access can abuse this to obtain tokens for privileged accounts (including those bound via Workload Identity), pivot to GCP APIs, or retain access after a pod is terminated. TokenRequest activity is recorded in Kubernetes audit logs as a create operation against the serviceaccounts/token subresource, making visibility dependent on audit coverage. The rule targets successful TokenRequest token creation in GCP audit logs while filtering out common legitimate system components and managed controllers. Investigations should correlate fields such as client.user.email, source.ip, user_agent.original, and gcp.audit.resource_name to identify the targeted service account and assess whether the actor has create permission on serviceaccounts/token. Remediation includes revoking or restricting TokenRequest permissions, rotating affected credentials, and reviewing related Workload Identity sessions and GCP API activity.