// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail since 8 Oct 2026 that names Lawson, Lawson ID or Ponta but was not sent from Lawson's domains.
// Lawson says its own notices to affected customers come from lawson_id@mailservice.lawson.jp.
let Since = datetime(2026-10-08T00:00:00Z);
let LurePattern = @"(?i)lawson|ローソン|ponta|ポンタ";
let OfficialDomains = @"(?i)(^|\.)(lawson\.co\.jp|lawson\.jp|REPLACE_WITH_OTHER_VERIFIED_DOMAIN)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
    EmailUrlInfo
    | where Timestamp > Since
    | project NetworkMessageId, UrlDomain
    ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500