// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail since 2 Oct 2026 that names Pharma DIGITAL or its operator but was not sent from their domains.
// Add your own HCP portal and brand names to LurePattern to watch for impersonation of your company.
let Since = datetime(2026-10-02T00:00:00Z);
let LurePattern = @"(?i)pharma ?digital|ファーマデジタル|医薬情報ネット|REPLACE_WITH_YOUR_PORTAL_NAME";
let OfficialDomains = @"(?i)(^|\.)(asahi-kasei\.co\.jp|akp-pharma-digital\.com|pin-japan\.com|pin-japan\.co\.jp)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
    EmailUrlInfo
    | where Timestamp > Since
    | project NetworkMessageId, UrlDomain
    ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500