URI protocol handler: search-ms

type.inbound
and any(attachments,
        .file_type == "html"
        and any(file.explode(.),
                any(.scan.strings.strings,
                    regex.contains(., 'search-ms:query.*location:\\\\')
                )
        )
)