Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
Order of volatility
The expensive mistake in the first hour is spending it on a source that will still be there tomorrow while one that rolls hourly quietly empties.
Memory, if the host is still running and you are permitted.
The change journal, which on a busy volume covers hours.
Event logs, 20MB by default and under a day on a domain controller.
Everything on disk, which is still there next week.
A legitimate account was used by an unauthorised person.
Collect first, these expire. The Security event log is 20MB by default and holds every authentication on the host. On a domain controller assume hours, not days.
A successful logon. It shows authentication, never who was at the keyboard. Behaviour after the logon, UserAssist and ShellBags for that profile, is what separates the account owner from somebody wearing their credentials.
if you find nothing
Impossible-travel and out-of-hours patterns need a baseline. Pull a normal week for the same account before deciding anything looks unusual.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
