Kerberos plugin for @volatilityfoundation.org allows you to list and extract tickets from memory dump. Another way to track user activity by checking services tickets !
github.com/airbus-cert/...
github.com
GitHub - airbus-cert/volatility-kerberos: Volatility plugin to deal with windows kerberos security provider, list, carve and dump Tickets
Volatility plugin to deal with windows kerberos security provider, list, carve and dump Tickets - airbus-cert/volatility-kerberos
