// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail since 9 Oct 2026 that names the brands whose mail-delivery services were affected, but was not sent from their domains.
// JR East, View Card and JR Kyushu say they will email affected members, so genuine notices will arrive too. Check a genuine message's headers before adding a sender domain.
let Since = datetime(2026-10-09T00:00:00Z);
let LurePattern = @"(?i)えきねっと|大人の休日倶楽部|ビューカード|view'?s ?net|jr東日本|jr九州|peach aviation|ピーチ|高島屋|takashimaya|idcf|idcフロンティア";
let OfficialDomains = @"(?i)(^|\.)(jreast\.co\.jp|eki-net\.com|jrkyushu\.co\.jp|flypeach\.com|takashimaya\.co\.jp|idcf\.jp|REPLACE_WITH_OTHER_VERIFIED_SENDER_DOMAIN)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
    EmailUrlInfo
    | where Timestamp > Since
    | project NetworkMessageId, UrlDomain
    ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500