During a threat hunt, an analyst reviews Windows event logs and EDR telemetry from an internal file server. They observe that a user account authenticated to the server using a Kerberos ticket, but no corresponding interactive logon or password entry was recorded on the source workstation. The same ticket was then used to access three additional servers within minutes. Which MITRE ATT&CK technique best describes this observed activity?