Rubeus overpass-the-hash

Rubeus.exe asktgt /user:<user> /rc4:<ntlm-hash> /ptt

Converts an NTLM hash into a Kerberos TGT ticket (Overpass-the-Hash).

When you have an NTLM hash of a user (e.g., via DCSync) and want to authenticate via Kerberos to avoid NTLM logs. The TGT allows using tools that require Kerberos authentication.

If the user does not have Kerberos authentication configured (e.g., local account). Also if the EDR detects Rubeus.