URL Phishing Overwhelms SOC Teams, Learn How to Accelerate Triage

Key Takeaways

• ANY.RUN has introduced a new URL Details investigation layer in its Sandbox environment.
• This enhancement aims to significantly accelerate the triage of URL phishing incidents for Security Operations Centers (SOCs).
• New features include dynamic in-browser data inspection, DOM modification visibility, and comprehensive evidence collection.
• SOC teams can expect reduced Mean Time To Detect (MTTD) to 15 seconds and Mean Time To Respond (MTTR) by up to 21 minutes per case.

ANY.RUN Sandbox Enhances Phishing Triage with New URL Details Layer

ANY.RUN has rolled out a significant update to its Sandbox platform, introducing a dedicated URL Details investigation layer designed to streamline the analysis and triage of URL phishing attempts. This new capability provides security operations teams with dynamic in-browser data inspection, offering deeper insights into malicious web pages and accelerating response times.

Advanced In-Browser Inspection and Contextual Data

The core of the new URL Details layer lies in its ability to conduct dynamic inspection of browser-level activities. Within the Interactive Sandbox, analysts can now view related contextual information, capture comprehensive screenshots, and identify Document Object Model (DOM) modifications that occur during a web page’s loading and execution. Crucially, relevant indicators are automatically collected and organized in a dedicated tab, facilitating more thorough and efficient analysis.

Leveraging this enhanced visibility, ANY.RUN has already demonstrated its effectiveness. By constructing a YARA rule based on snapshots of identified phishing pages, the platform successfully pinpointed 145 related malicious samples, underscoring its potential for proactive threat identification.

Operational Efficiency Gains for SOCs

These advancements translate directly into substantial operational improvements for Security Operations Centers (SOCs). The Mean Time To Detect (MTTD) malicious activity has been drastically cut to an average of just 15 seconds, enabling analysts to identify threats much earlier in the triage process. Furthermore, the Mean Time To Respond (MTTR) is projected to decrease by up to 21 minutes per incident. This reduction is attributed to clearer evidence presentation, faster verdict generation, and a decreased reliance on manual verification steps.

The improved context provided by the URL Details layer empowers Tier 1 SOC analysts to confidently confirm or close a greater number of cases, thereby minimizing unnecessary escalations to more senior teams. When escalation becomes necessary, Tier 2 and Tier 3 analysts receive a complete evidence package rather than fragmented data, ensuring smoother handoffs and accelerating advanced investigations. This comprehensive evidence, including browser-level artifacts and related threat context, also strengthens an organization’s overall detection capabilities, allowing teams to develop more robust rules, refine threat hunting logic, and expand their coverage against phishing campaigns. Ultimately, these efficiencies allow analysts to dedicate less time to manually reconstructing attack flows and more time to addressing critical security threats, leading to more effective and responsive SOC operations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.