// Defender XDR Advanced Hunting. Read-only; not live-tested.
let TargetRecipient = "REPLACE_WITH_REPORTED_RECIPIENT";
EmailEvents
| where Timestamp between (ago(7d) .. now())
| where EmailDirection == "Inbound"
| where RecipientEmailAddress =~ TargetRecipient
| where Subject contains "大和証券" or Subject contains "Daiwa"
    or SenderDisplayName contains "大和証券" or SenderDisplayName contains "Daiwa"
| project Timestamp, NetworkMessageId, RecipientEmailAddress,
    SenderFromAddress, SenderDisplayName, Subject, DeliveryAction,
    DeliveryLocation, ThreatTypes, AuthenticationDetails
| order by Timestamp desc
| take 500