// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail that uses the GMO and Onamae.com names but does not come from GMO's real sending domains.
// Expect lures about password resets, the 5,000 yen payment, loss compensation, replacement PCs and "check if your data leaked".
let Since = ago(14d);
let Legitimate = @"(?i)(^|\.)(REPLACE_WITH_LEGITIMATE_GMO_DOMAINS)$";   // for example: onamae\.com|gmo\.jp
EmailEvents
| where Timestamp > Since and EmailDirection == "Inbound"
| where Subject contains "お名前" or Subject contains "デスクトップクラウド"
    or Subject contains "GMO" or Subject contains "onamae"
| where not(SenderFromDomain matches regex Legitimate)
| project Timestamp, RecipientEmailAddress, SenderFromAddress, SenderMailFromDomain,
    Subject, AuthenticationDetails, DeliveryAction, ThreatTypes
| order by Timestamp desc