Detects when a Workspace user copies a document, spreadsheet, form, or script from an external Drive into their My Drive and, within minutes from the same IP, authorizes a custom web OAuth client that requests an Apps Script scope. `script.container` is the container sidebar or dialog. The check also matches any other `script.*` scope, a `*.currentonly` scope, or a scope containing `scripts` or `container`. Adversaries send spearphishing links with a /copy URI parameter so the victim replicates a malicious object locally. Google names that replica with a "Copy of " prefix. The copy is performed by a domain user rather than a collaborator account, and the consent is not a known Google first-party client.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.