ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service
https://sockanalyst.com/patch-now/arara-message-email-delivery-breach-81-million

Splunk
index=email (sourcetype=*o365* OR sourcetype=*proofpoint* OR sourcetype=*mimecast*)
(subject="*パスワード*" OR subject="*password*" OR subject="*カード*" OR subject="*card*" OR subject="*アララ*" OR subject="*ARARA*")
| eval sender_domain=lower(mvindex(split(sender,"@"),1))
| lookup newsletter_brand_domains sender_domain OUTPUT is_brand
| where isnull(is_brand)
| stats count dc(recipient) as recipients values(subject) as subjects by sender_domain, src_ip
| sort - recipients
// Brand/newsletter-themed phishing from non-brand domains after the ARARA leak

Sentinel
EmailEvents
| where TimeGenerated > ago(30d)
| where Subject has_any ("ARARA","アララ","password","パスワード","card","カード","newsletter","メルマガ")
| where DeliveryAction == "Delivered" and (AuthenticationDetails has "fail" or ThreatTypes has "Phish")
| summarize Recipients=dcount(RecipientEmailAddress), Msgs=count(), Subjects=make_set(Subject, 10) by SenderFromDomain, SenderIPv4
| order by Recipients desc
// Delivered phishing with failed auth themed on brands/newsletters that used ARARA