Explain Pass-the-Hash, Pass-the-Ticket, and Pass-the-Key.

All authentication abuse techniques in Windows AD. PtH — use NTLM hash directly (without knowing password) to authenticate to remote service. Tools: Mimikatz sekurlsa::pth, Impacket secretsdump → wmiexec. PtT — use Kerberos ticket (TGT or TGS) without knowing password. Common: dump tickets from compromised host with Mimikatz, replay on attacker box. PtK — use Kerberos AES key (256/128) without password — works because AES keys derive from password and timestamp. Newer than PtH, harder to detect. Defence: Credential Guard, restricted-mode RDP, LSA Protection, Protected Users group, regular Kerberos ticket lifetime reduction.