Steal Application Access Token

This record covers the OAuth-consent variant of T1528: an unapproved application is granted delegated permission by a target user or administrator, producing an application access token that can be used against the granted resource. The identity-provider authorization endpoint must be Internet-reachable and the requested consent must be granted; this variant needs no internal network foothold. The token's audience, scopes, policy, and expiration constrain use, while a stolen refresh token may allow renewal. This procedure is distinct from LSASS credential dumping, web session-cookie theft, and Kerberos ticket requests.