An analyst sees an attacker replaying a stolen SaaS OAuth token to list storage buckets via API, with no OS process or password logon. Which ATT&CK technique category should guide the mapping?

Replaying a stolen OAuth token maps to ATT&CK T1550.001, Use Alternate Authentication Material: Application Access Token, because the artifact is a bearer token used to make authorized API requests in cloud and SaaS services rather than a password or a compromised local OS credential. In response mapping, the analyst records the tactic and technique that explain API-based access to cloud resources, then traces the token source, scope, expiration, and conditional-access gaps. A host credential-access category is wrong because SAM, LSASS, or local password hashes describe Windows or local OS secrets and would require host telemetry, not SaaS API calls. A network lateral-movement category is wrong because pass-the-hash or remote service abuse moves across hosts using network authentication protocols, whereas the observed behavior is a bearer token accepted by a cloud service. A mobile session-hijacking category is wrong because webview or app-session abuse targets mobile application runtime controls and device-side session storage, not cloud identity APIs. Exam caveat: ATT&CK techniques can overlap, so choose the one that matches the primary evidence source and control plane. Operational check: correlate the token identifier, issuing tenant, granted scopes, and API calls, then revoke or rotate the token and review conditional-access policies.