//CW - 15/05/2026 - Phishing Campaign alert based on Subject
let WhiteListedSenderDomains = pack_array(
    'wales.domain',
    'microsoft.com'
);
EmailEvents
| where UrlCount >0
    and DeliveryLocation !in ("Quarantine", "Failed")
| where SenderFromDomain !in (WhiteListedSenderDomains)
    and SenderMailFromAddress !contains "bounce"
    and SenderMailFromAddress !contains "no-reply@"
| where TimeGenerated >= ago(7d)
| where Subject matches regex @"([fF]ile|[dD]ocument|[sH]ared)"
| join kind=innerunique (IdentityInfo
     | where Timestamp > ago (30d)
     | where DistinguishedName contains_cs "HDD/PATH"
     )
on $left.RecipientEmailAddress== $right.EmailAddress
| summarize Recipients = make_set(RecipientEmailAddress) by Subject, SenderFromAddress
| extend RecipientsConcatenated = strcat_array(Recipients, "; ")
| where tolower(RecipientsConcatenated) matches regex @"(?:[a-z1-9\.]{0,50}@wales\.nhs\.uk;\s){4,}[a-z1-9\.]{0,50}@wales\.nhs\.uk"