// Illustrative only; not executed against a tenant.
// Microsoft Defender XDR: requires Defender for Office 365 EmailEvents.
// UTC window; adjust to your retention and investigation period.
let Start = datetime(2026-09-28T00:00:00Z);
let End = datetime(2026-10-18T00:00:00Z);
let OfficialDomains = dynamic(["kuronekoyamato.co.jp", "yamato-hd.co.jp"]);
EmailEvents
| where Timestamp >= Start and Timestamp < End
| where EmailDirection == "Inbound"
| extend Text = strcat(Subject, " ", SenderDisplayName),
         SenderDomain = tolower(SenderFromDomain)
| where Text contains "ヤマト" or Text contains "クロネコ"
    or Text contains "yamato" or Text contains "kuroneko"
| where SenderDomain !in (OfficialDomains)
    and not(SenderDomain endswith ".kuronekoyamato.co.jp")
    and not(SenderDomain endswith ".yamato-hd.co.jp")
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain,
          SenderDisplayName, Subject, RecipientEmailAddress, DeliveryAction, ThreatTypes
| order by Timestamp desc