eKeys

Use Kerberos key material recovered from a logon session to request a domain TGT without the plaintext password, then request a service ticket for an in-scope service. Mimikatz sekurlsa::ekeys can display AES and RC4-HMAC keys from LSASS; using the NTLM-derived RC4 key for the TGT request is an Overpass-the-Hash procedure mapped to T1550.002. A Kerberos ticket request follows the normal protocol and does not by itself prove service access or guarantee reduced detection.