// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail since 9 Oct 2026 that names skyticket but was not sent from its domain.
// Adventure says it is emailing affected customers and warns of fakes posing as the company, banks, airlines and bus operators.
let Since = datetime(2026-10-09T00:00:00Z);
let LurePattern = @"(?i)skyticket|スカイチケット";
let OfficialDomains = @"(?i)(^|\.)(skyticket\.jp|REPLACE_WITH_OTHER_VERIFIED_SENDER_DOMAIN)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
    EmailUrlInfo
    | where Timestamp > Since
    | project NetworkMessageId, UrlDomain
    ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500