Applying Shanon Entropy to SenderDomains via Kusto

The article presents a KQL-based threat hunting technique to surface look-alike and typosquatted sender domains by approximating Shannon entropy via structural similarity (prefix/suffix), digit/symbol density, length drift, and frequency baselining, producing a SuspicionScore to prioritize findings. It includes helper functions, configuration parameters, integration with EmailEvents and EmailUrlInfo, and practical filtering/tuning advice for converting the hunt into a reliable detection rule.