Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
An account authenticated to this host interactively from elsewhere.
Collect first, these expire. The Security event log is 20MB by default. On a domain controller that can be under a day, and on a busy one a few hours. Export it before anything else.
A 4624 on its own. Logon Type is what separates RDP (type 10) from a share mount (type 3), and the source IP may be a pivot rather than the origin: the same account arriving from three hosts in an hour is the finding, not any single event.
if you find nothing
The Security log is 20MB by default. On a domain controller that can be under a day, so a gap usually means the log rolled, not that nothing happened.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
