[New Rule] Google Workspace Suspicious File Type Downloads from Drive Followed by Execution

## Summary
Google released from research into Google Workspace being used for C2, specifically involving Drive where file types are Sheets, Golang and PE.

Reference: https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
Tool: https://github.com/looCiprian/GC2-sheet

With the Google Workspace integration, there is enough logging and details to create an EQL sequence rule for this activity. Initially the thought is to use EQL to create a sequence where file types like GoLang are downloading files from a Drive link or receiving commands from a Sheets URL. This can be sequenced by host and traced with parent-child process to follow execution of the malicious binary shortly afterwards.