Use of Stolen Token to Access Secrets

Use a previously obtained valid application access token to authenticate to a remote service and access resources allowed by that token's policy. This record's concrete example uses a HashiCorp Vault client token to read a KV v2 secret. Obtaining or extracting the token is a prerequisite and is not part of this procedure; web session-cookie use is a separate ATT&CK sub-technique.