A SOC analyst investigates a suspected lateral movement incident involving a compromised service account. The analyst needs to correlate evidence of the attacker's initial access, persistence mechanism, and subsequent privilege escalation within the same time window. Which combination of Windows Event Log sources should the analyst query to capture these specific activities?

Tracing a compromised service account means matching each attack stage to the channel that records it. Initial access with stolen credentials appears in the Security log as successful logons, event 4624, which record the logon type, source address and account. Privilege escalation shows up as event 4672, which marks a logon that received sensitive privileges such as SeDebugPrivilege, and event 4732, which records a member being added to a security-enabled local group such as Administrators. Persistence commonly lands in the System log as event 7045 when a new service is installed, or in the Task Scheduler operational log when a scheduled task is created. The option built on failed logons and DNS client events misses escalation entirely, and failed logons do not show an attacker using a valid compromised credential. The option pairing application errors with script block logging covers execution detail but has no logon or escalation evidence. The option with privilege use and application errors lacks both the logon trail and the scheduled task record. On the exam, look for the answer that covers every requested stage, not just one. Operationally, correlate by the Logon ID shared between 4624 and 4672, then pivot on the same time window to 7045 and task creation events.