A threat hunter in Microsoft Defender XDR Advanced Hunting must correlate the most recent successful interactive sign-in for a set of high-value servers with any process that spawned an outbound connection to a newly published command-and-control domain during the same session window. Which combination of tables should the hunter join to build this query most accurately?