// Defender XDR Advanced Hunting. Read-only; not live-tested.
let TargetRecipient = "REPLACE_WITH_REPORTED_RECIPIENT";
EmailEvents
| where Timestamp between (ago(7d) .. now())
| where EmailDirection == "Inbound"
| where RecipientEmailAddress =~ TargetRecipient
| where Subject contains "焼肉きんぐ" or Subject contains "Yakiniku King"
    or SenderDisplayName contains "焼肉きんぐ" or SenderDisplayName contains "Yakiniku King"
| project Timestamp, NetworkMessageId, RecipientEmailAddress,
    SenderFromAddress, SenderDisplayName, Subject, DeliveryAction,
    DeliveryLocation, ThreatTypes, AuthenticationDetails
| order by Timestamp desc
| take 500