Attachment: Link file with UNC path

type.inbound
and any(attachments,
        .file_extension in ("lnk", "url")
        and any(file.explode(.),
                any(.scan.strings.strings,
                    regex.icontains(., '\\\\([a-zA-Z0-9_:%.$-]+)\\([a-zA-Z0-9_:%.$-]+)')
                ) // normal UNC paths
                or any(.scan.strings.strings,
                       regex.icontains(., '%5C%5C([a-zA-Z0-9_:%.$-]+)%5C([a-zA-Z0-9_:%.$-]+)')
                ) // percent-encoded UNC paths
        )
)