// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Card-company lures sent through breached mail-delivery platforms, from 14 October 2026.
// The two senders and the three subjects are the ones Arara and Yumirin Link published; real card notices can share a subject, so check the sender.
let Since = datetime(2026-10-14);
let PlatformSenders = dynamic(["news@arara.com", "info@cuenote.jp"]);
EmailEvents
| where Timestamp >= Since and EmailDirection == "Inbound"
| where SenderFromAddress in~ (PlatformSenders)
    or Subject contains "利用内容確認のご依頼"
    or Subject contains "ご利用明細確認のご依頼"
    or Subject contains "ご利用確認のお願い"
| project Timestamp, RecipientEmailAddress, SenderDisplayName, SenderFromAddress,
    SenderMailFromDomain, Subject, AuthenticationDetails, DeliveryAction, DeliveryLocation, NetworkMessageId
| order by Timestamp desc