Microsoft ATP Safelinks Decoding

[obsidianforensics]

Description Some Microsoft products rewrite links to go through their scanning engine. Extracting the destination URL is simple enough, but it looks like there's more interesting stuff in the link as well.

Examples

• https://nam02.safelinks.protection.outlook.com/?url=https://dfir.blog/unfurl&data=02|01|[email protected]|redacted&sdata=om5tJuXTaeMuWKSxdMvR9uSiZLTcvszo7g6bYJH65QE=&reserved=0

References

• Safe Links in Microsoft Defender for Office 365