Kerberos plugin for @volatilityfoundation.org allows you to list and extract tickets from memory dump. Another way to track user activity by checking services tickets !
github.com/airbus-cert/...
Volatility plugin to deal with windows kerberos security provider, list, carve and dump Tickets - airbus-cert/volatility-kerberos