type.inbound
and all(body.links, .href_url.domain.root_domain in $url_shorteners)
and any(body.links,
regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
'search-ms:[^\;]*query=[^\;]+\.lnk'
)
)
Playground
Test against your own EMLs or sample data.