// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Devices that contacted domains resembling Pharma DIGITAL, other than the official site.
let Since = datetime(2026-10-02T00:00:00Z);
DeviceNetworkEvents
| where Timestamp > Since
| where isnotempty(RemoteUrl)
| where RemoteUrl matches regex @"(?i)pharma[-_.]?digital|REPLACE_WITH_YOUR_PORTAL_PATTERN"
| where not(RemoteUrl matches regex @"(?i)(^|[/.])akp-pharma-digital\.com([/:]|$)")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Processes = make_set(InitiatingProcessFileName, 5)
    by DeviceName, RemoteUrl
| order by FirstSeen asc
| take 500