Detecting Emails Sent Using Unexpected Languages (+KQL Query)

This post describes a KQL-based threat-hunting technique that flags emails whose detected language (from telemetry) does not match the expected languages for the sender's geolocated country, using an external CSV mapping for language expectations; it includes the full query, tuning recommendations, and a caution that language mismatch is a weak indicator best used with other signals.