type.inbound
and any(attachments,
// handle directly attached files first
(
.file_extension == "library-ms"
// and contains a url with the \\
and strings.icontains(file.parse_text(.).text, '<url>\\')
)
// handle library-ms files inside of archives
or (
.file_extension in $file_extensions_common_archives
and any(file.explode(.),
// the exploded archive contained a file with the library-ms extension
.file_extension == "library-ms"
// and the strings in that file contain the required url variable
and any(.scan.strings.strings, strings.contains(., '<url>\\'))
)
)
)
Playground
Test against your own EMLs or sample data.