Detects creation or modification of a Kubernetes Service object with type NodePort in Google Kubernetes Engine (GKE) by monitoring Google Cloud Audit Logs (gcp.audit). NodePort exposes a static port on every worker node, forwarding external traffic to labeled pods and expanding the cluster’s external attack surface, potentially bypassing cloud load balancers and firewall controls. The rule triggers when the GCP audit dataset indicates a Kubernetes Service create/update/patch (io.k8s.core.v1.services.create, .update, or .patch) and the request type is NodePort, while excluding patches performed by system:addon-manager on existing NodePort Services. It uses fields such as gcp.audit.resource_name, gcp.audit.request, client.user.email, source.ip, and user_agent.original to identify the service name, namespace, selectors, and port for triage. The rule is tied to MITRE ATT&CK techniques External Remote Services (T1133) under both Persistence (TA0003) and Initial Access (TA0001), reflecting the risk of unauthorized external entry into the cluster. A GKE audit-log fleet integration and request-body capture are required to populate relevant fields for accurate detection. False positives may occur for legitimate use of NodePort in lab or automation contexts, and addon-manager reconciliations are excluded from alerting; remain vigilant for other NodePort changes. Remediation includes removing unauthorized NodePort Services, tightening RBAC on Services writes, and reviewing firewall exposure on opened ports.