Kerberos plugin for @volatilityfoundation.org allows you to list and extract tickets from memory dump. Another way to track user activity by checking services tickets ! github.com/airbus-cert/...
GitHub - airbus-cert/volatility-kerberos: Volatility plugin to deal with windows kerberos security provider, list, carve and dump Tickets
Volatility plugin to deal with windows kerberos security provider, list, carve and dump Tickets - airbus-cert/volatility-kerberos
github.com