<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-link-sandboxing
description: >-
  Deploy and configure URL sandboxing solutions that detonate suspicious links
  in isolated environments, rewrite URLs for time-of-click protection, and
  integrate verdict feeds into email gateway and SIEM workflows.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - url-sandboxing
  - link-rewriting
  - time-of-click
  - url-detonation
  - safe-links
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.002"]
---

# Implementing Link Sandboxing

## Overview

Link sandboxing intercepts URLs in email and detonates them in isolated
environments before or at the time of user click. This skill covers deploying
URL rewriting (Safe Links, Proofpoint URL Defense), configuring detonation
policies, handling evasion techniques (CAPTCHAs, geo-fencing, time-delayed
payloads), and integrating sandbox verdicts into detection workflows.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `requests` | `pip install requests` — HTTP client |
| `playwright` | `pip install playwright && playwright install` — browser automation |
| Sandbox API access | VirusTotal, urlscan.io, or internal sandbox |
| `jq` | JSON processing |

## Key Concepts

### URL Rewriting Flow

```
Original URL in email
  → Mail gateway rewrites to proxy URL
    → User clicks proxy URL
      → Sandbox detonates original URL in isolated browser
        → Verdict: clean / suspicious / malicious
          → Clean: redirect to original
          → Malicious: block and show warning page
```

### Evasion Techniques to Counter

| Evasion | Detection | Mitigation |
|---|---|---|
| CAPTCHA gate | Page analysis for CAPTCHA elements | Browser automation with CAPTCHA handling |
| Geo-fencing | Detonate from multiple regions | Multi-region sandbox deployment |
| Time-delayed payload | Re-scan at click time | Time-of-click detonation policy |
| Fingerprint sandbox | Mimic real browser profile | Realistic user-agent and viewport |
| Redirect chain | Follow all redirects | Max-redirect tracing with full chain logging |
| URL shortener abuse | Expand shortened URLs | Pre-expand all bit.ly, t.co, etc. |

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Link | T1566.002 | Malicious link in email |
| User Execution: Malicious Link | T1204.001 | User clicks malicious link |

## Workflow

### 1. URL Extraction and Expansion

```bash
# Extract URLs from email body
node agent.js extract-urls --email /tmp/suspect_email.eml

# Expand shortened URLs
node agent.js expand-url --url "https://bit.ly/abc123"

# Batch expand all URLs from an email
node agent.js batch-expand --url-file /tmp/extracted_urls.txt
```

### 2. Sandbox Detonation

```bash
# Submit URL to urlscan.io
node agent.js detonate --url "https://suspicious-site.com/login" \
  --sandbox urlscan --api-key "${URLSCAN_API_KEY}"

# Submit to VirusTotal
node agent.js detonate --url "https://suspicious-site.com/login" \
  --sandbox virustotal --api-key "${VT_API_KEY}"

# Check detonation verdict
node agent.js verdict --scan-id "abc123-def456" --sandbox urlscan
```

### 3. Configure Safe Links Policy

```bash
# Generate Safe Links policy configuration
node agent.js generate-policy --provider m365 \
  --track-clicks true --scan-internal true \
  --do-not-rewrite-list "company.com,trusted-partner.com"

# Audit current rewriting coverage
node agent.js audit-coverage --mail-log /var/log/mail/urls.csv
```

### 4. Verdict Integration

```bash
# Generate SIEM alert for malicious verdict
node agent.js generate-alert --verdict malicious \
  --url "https://phish.com/harvest" --recipient "user@company.com"
```

## Detection

```yaml
title: Link Sandboxing Detection
id: ce5eec05-c603-47fa-a9fa-7e6819002577
status: experimental
description: Detects suspicious activity related to implementing link sandboxing techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.002
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| URLs extracted | All hrefs and plain-text URLs captured |
| Shortened URLs expanded | Final destination resolved |
| Sandbox detonation succeeded | Scan ID returned with pending/complete status |
| Verdict retrieved | Clean/suspicious/malicious classification |
| Policy generated | Safe Links config matches requirements |
| Alert generated | SIEM-compatible alert JSON produced |

## References

- [Microsoft Safe Links Documentation](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)
- [urlscan.io API](https://urlscan.io/docs/api/)
- [VirusTotal URL API](https://docs.virustotal.com/reference/url-info)
- [Proofpoint URL Defense](https://www.proofpoint.com/us/products/advanced-threat-protection)
