<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Email Threat Hunting

## KQL — Microsoft Sentinel / Defender
```kql
// BEC pattern
EmailEvents | where SenderFromDomain != "example.com"
| where SenderDisplayName has_any ("CEO", "CFO")

// Credential harvesting
EmailUrlInfo | where Url has_any ("login", "signin")

// Lateral phishing
EmailEvents | where SenderFromDomain == "example.com"
| summarize dcount(RecipientEmailAddress) by SenderFromAddress
```

## Splunk
```spl
index=email sourcetype=exchange sender_domain!="example.com"
| search sender_display_name IN ("CEO*", "CFO*")

index=o365 Operation IN ("New-InboxRule", "Set-InboxRule")
| where match(Parameters, "ForwardTo")
```

## Exchange PowerShell
```powershell
Search-UnifiedAuditLog -Operations "New-InboxRule" -StartDate (Get-Date).AddDays(-7)
```
