One unfortunate consequence of the aforementioned techniques is that they obtain handles to sensitive resources, which can be audited and logged quite easily. Rubeus is a C# tool designed for Kerberos interaction and abuses, using legitimate Windows APIs.
Its triage command will list all the Kerberos tickets in your current logon session and if elevated, from all logon sessions on the machine.
Each user has their own logon session, which is represented by a LUID (locally unique identifier). In this example, we're operating within the LUID of bfarmer, 0x14b5fa. The WKSN-2$ machine account has its own session, 0x3e4; and jking also has a session, 0x7049f. Tickets for the service name krbtgt are Ticket Granting Tickets (TGTs) and others are Ticket Granting Service Tickets (TGSs). The different ticket types are described in more detail in the Kerberos chapter.
Rubeus' dump command will extract these tickets from memory - but because it uses WinAPIs, it does not need to open suspicious handles to LSASS. If not elevated, we can only pull tickets from our own session. Without any further arguments, Rubeus will extract all tickets possible, but we can be more specific by using the /luid and /service parameters.
For example, if we only wanted the TGT for jking, we can do: