// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting; needs Defender for Office 365.
// Inbound mail since 2 Oct 2026 whose visible From domain is Burger King Japan's but which did not pass DMARC.
// The domain's DMARC policy was p=none on 17 Oct 2026, so receiving servers are not asked to reject such mail.
// AuthenticationDetails holds verdicts such as {"SPF":"pass","DKIM":"pass","DMARC":"pass","CompAuth":"pass"};
// if DMARC comes back empty in your tenant, every message is kept, so check the column before trusting a quiet result.
let Since = datetime(2026-10-02T00:00:00Z);
let BrandDomain = @"(?i)(^|\.)burgerking\.co\.jp$";
let KnownForwarders = dynamic(["REPLACE_WITH_FORWARDING_RELAY_IP"]); // forwarding breaks SPF; list your own relays
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex BrandDomain
| where not(SenderIPv4 in (KnownForwarders))
| extend Auth = parse_json(AuthenticationDetails)
| extend DMARC = tostring(Auth.DMARC), SPF = tostring(Auth.SPF), DKIM = tostring(Auth.DKIM), CompAuth = tostring(Auth.CompAuth)
| where DMARC != "pass"
| summarize Messages = count(), Recipients = dcount(RecipientEmailAddress),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderMailFromDomain, SenderIPv4, DMARC, SPF, DKIM, CompAuth, DeliveryAction
| order by Messages desc
| take 500