GAIA GCPW Credential Theft Attack Chain

Detects the GAIA (Google Account Information and Authentication) credential theft attack chain: credential dumping tool execution on Windows followed by anomalous Google Workspace authentication. This pattern indicates an attacker has extracted OAuth refresh tokens from a Windows machine and is using them to authenticate to Google Workspace.