Listen to this Post
Introduction:
Modern phishing attacks have evolved far beyond simple static pages. Attackers now deploy layered redirect chains, client-side scripts, iframe injections, and dynamic DOM manipulations that unfold entirely within the browser—yet most SOC workflows remain anchored in static analysis, leaving critical evidence invisible. ANY.RUN’s new in-browser data inspection capability closes this visibility gap by delivering full static and dynamic URL context in a single view, enabling analysts to detect phishing threats faster and reduce mean time to respond (MTTR) by up to 21 minutes per case.
Learning Objectives:
- Understand how in-browser data inspection provides browser-level visibility into phishing attack chains, including redirects, scripts, DOM changes, and form interactions
- Learn to operationalize browser telemetry for faster triage, validated escalations, and stronger detection engineering
- Master the integration of ANY.RUN’s Interactive Sandbox with SIEM, SOAR, and threat intelligence platforms to automate and scale phishing investigations
- Closing the Phishing Visibility Gap with Browser-Level Telemetry
Traditional URL analysis forces SOC analysts to piece together evidence across multiple disconnected tools: sandbox reports, network logs, screenshots, and manual redirect tracing. This fragmented workflow can take up to an hour per URL, and even then, critical details often remain hidden. In-browser data inspection solves this by executing the suspicious URL inside a real browser environment and capturing everything that happens—redirects, scripts, DOM changes, user-facing content, and form interactions—in a single, structured view.
What This Does: The capability collects browser-level telemetry including page content, rendered screenshots, forms, scripts, DOM modifications, redirect chains, URLs, domains, IP addresses, and other browser-level artifacts. Color highlights and tags point to pages responsible for triggering detections, accelerating triage decisions.
How to Use It:
- Access the Browser Data Tab: Within ANY.RUN’s Interactive Sandbox, open the Browser Data tab for any URL analysis to access a complete, dynamic view of web page execution.
- Examine the Execution Tree: Review the full web page execution tree from initial URL to final page view, featuring all redirects and activated iframes.
- Inspect HTTP Requests: Analyze detailed HTTP request data to reconstruct redirect chains and collect evidence for IDS detections and network-based hunting rules.
- Review DOM Changes: Navigate to the HTML DOM Changes tab to reveal code fragments injected after page load—content that static analysis always misses.
- Extract Indicators: Collect URLs, domains, IP addresses, and hashes of web content to pivot across related infrastructure or build custom detection rules.
Linux/Windows Commands for Enrichment:
For teams building their own browser-based detection pipelines, here are practical commands to complement sandbox analysis:
Linux – Extract URLs from suspicious emails:
grep -oP '(https?://[^\s"]+)' suspicious_email.eml | sort -u > extracted_urls.txt
Linux – Bulk URL reputation check using VirusTotal CLI:
for url in $(cat extracted_urls.txt); do curl -s "https://www.virustotal.com/api/v3/urls/$(echo -1 $url | sha256sum | cut -d' ' -f1)" -H "x-apikey: $VT_API_KEY"; done
Windows PowerShell – Extract and analyze redirect chains:
$url = "https://suspicious-domain.com/phishing"
$response = Invoke-WebRequest -Uri $url -MaximumRedirection 0 -ErrorAction SilentlyContinue
while ($response.StatusCode -eq 302) {
Write-Host "Redirecting to: $($response.Headers.Location)"
$url = $response.Headers.Location
$response = Invoke-WebRequest -Uri $url -MaximumRedirection 0 -ErrorAction SilentlyContinue
}
- Automating Phishing Analysis with ANY.RUN’s SDK and API
To scale in-browser data inspection across enterprise SOC environments, ANY.RUN provides a Python SDK and REST API that enable seamless integration with SIEM, SOAR, and XDR platforms. The SDK supports both synchronous and asynchronous interfaces and works with Python 3.5 through 3.13.
What This Does: The SDK allows security teams to automatically submit files and URLs for analysis, monitor analysis progress in real time, get detailed reports, and manage tasks programmatically. It also enables deep searches across 50+ million threat records using over 40 search parameters, including TTPs, YARA rules, and Suricata signatures.
How to Use It (Step-by-Step):
1. Install the SDK:
pip install anyrun-sdk
2. Initialize the Sandbox Connector:
import os
from anyrun.connectors import SandboxConnector
api_key = os.getenv('ANY_RUN_SANDBOX_API_KEY')
with SandboxConnector.android(api_key) as connector:
Submit URL for analysis
analysis_id = connector.run_url_analysis('https://suspicious-domain.com/login')
print(f'Analysis UUID: {analysis_id}')
3. Monitor Analysis Progress in Real Time:
for status in connector.get_task_status(analysis_id): print(status)
4. Retrieve Verdict and Report:
verdict = connector.get_analysis_verdict(analysis_id)
if verdict in ('Suspicious', 'Malicious'):
connector.get_analysis_report(analysis_id, report_format='html', filepath='.')
5. Clean Up:
connector.delete_task(analysis_id)
TI Lookup Integration – Hunt for Related Threats:
from anyrun.connectors import TILookupConnector
with TILookupConnector(api_key) as connector:
Search for IOCs using YARA rules
results = connector.yara_search('phishing_credential_harvest')
for result in results:
print(f"Found: {result['threat_name']} - {result['indicators']}")
3. DOM Change Analysis: Uncovering Hidden Phishing Content
One of the most powerful features of in-browser data inspection is the ability to track DOM changes across every stage of page execution. Phishing attackers frequently inject malicious content after the initial page load—content that static HTML analysis never detects.
What This Does: The HTML DOM Changes tab reveals code fragments added to the DOM after page load, including hidden forms, injected scripts, and dynamically loaded iframes. This exposes the fully rendered and interactive state of the page, allowing analysts to see actual behavior including hidden forms, redirects, and user interaction logic that were impossible to understand statically.
How to Use It:
- Navigate to the DOM Changes Tab: Within any URL analysis in ANY.RUN, click the HTML DOM Changes tab.
- Review Injected Content: Examine all code fragments that were added to the DOM after the page loaded—these are the elements static analysis misses.
- Identify Hidden Forms: Look for credential harvesting forms that only appear after user interaction or redirect completion.
- Extract Behavioral Artifacts: Use the identified phishing elements to reconstruct the loading process and strengthen threat hunting and detection engineering.
Practical Command – Detect DOM Injection Patterns:
Linux – Use `curl` and `diff` to compare static vs. rendered content:
Fetch initial HTML
curl -s https://suspicious-site.com > initial.html
Use a headless browser to capture post-render DOM
node -e "const puppeteer=require('puppeteer'); (async()=>{const b=await puppeteer.launch();const p=await b.newPage();await p.goto('https://suspicious-site.com');await p.waitForTimeout(3000);console.log(await p.content());await b.close();})();" > rendered.html
Compare differences
diff initial.html rendered.html
4. Building YARA Rules from Phishing Page Snapshots
In-browser data inspection automatically collects indicators including URLs, domains, IP addresses, and hashes of web content associated with the analyzed page. This evidence can be used to create custom YARA rules for threat hunting and detection engineering.
What This Does: Content extracted from web page snapshots enables analysts to create custom hunting and detection rules backed by ANY.RUN Threat Intelligence. In one example, a single YARA rule created from a phishing page snapshot identified 145 related samples within Threat Intelligence Lookup.
How to Use It:
- Extract Page Artifacts: From the Browser Data view, collect all extracted indicators including hashes of web content, URLs, and IP addresses.
- Identify Unique Patterns: Look for distinctive strings, code fragments, or structural markers in the page content that can link to known threats.
3. Create a YARA Rule:
rule Phishing_Credential_Harvest {
meta:
description = "Detects credential harvesting phishing pages"
author = "SOC Team"
strings:
$login_form = /<form.action=["']https?:\/\/[^"']+["']/
$cred_field = /input.(name|id)=<a href="user|pass|email|password">"'</a>["']/
$hidden_redirect = /window.location.href.=.["']https?:\/\//
condition:
$login_form and $cred_field and $hidden_redirect
}
4. Search Across Threat Intelligence: Use ANY.RUN’s YARA Search to query the 50+ million threat database for samples matching your rule.
5. Refine and Deploy: Continuously refine rules based on new phishing campaigns and deploy them across SIEM, IDS/IPS, and EDR solutions.
- Integrating In-Browser Visibility with SIEM and SOAR Workflows
ANY.RUN’s flexible API and pre-built connectors enable seamless integration with leading SIEM, SOAR, EDR, and XDR platforms including Splunk, Rapid7 InsightIDR, Google Security Operations, and more. The sandbox can operate in automated mode, fully detonating complex phishing and malware attacks including solving CAPTCHAs and scanning QR codes.
What This Does: Integration enables automated submission of suspicious URLs from SIEM alerts, real-time enrichment of incidents with browser-level evidence, and automated report generation for escalation and response.
How to Use It:
- Configure API Key Authentication: Generate an API key from your ANY.RUN account settings.
- Set Up SIEM/SOAR Connector: Follow the specific integration documentation for your platform (Splunk, Rapid7, Google SecOps, etc.).
- Create Automated Playbooks: Build SOAR playbooks that automatically submit suspicious URLs to ANY.RUN upon SIEM alert creation, wait for analysis completion, and enrich the alert with browser-level evidence.
- Automate Report Generation: Configure the system to generate SOC-ready reports that transform complex investigations into decision-ready intelligence.
- Monitor and Optimize: Track MTTR reduction and analyst workload metrics to continuously optimize the integration.
Sample SOAR Playbook Logic (Pseudocode):
ON SIEM Alert (Phishing URL Detected): EXTRACT url FROM alert SUBMIT url TO ANY.RUN Sandbox (via API) WAIT FOR analysis completion FETCH Browser Data (redirects, DOM changes, screenshots) ENRICH alert with browser-level evidence IF verdict == "Malicious": ESCALATE to Tier 2 with complete evidence package ELSE: CLOSE alert with confidence
- Advanced Threat Hunting with TI Lookup and Suricata Rules
ANY.RUN’s Threat Intelligence Lookup provides a searchable database of IOCs, IOAs, IOBs, and events collected from over 600,000 researchers and 15,000 corporate clients. The platform continuously adds 16,000+ new threats daily and supports over 40 search parameters.
What This Does: Analysts can look up any suspicious indicator—URLs, domains, IPs, file hashes, TTPs, YARA rules, or Suricata signatures—to uncover contextual threat information and track attacker infrastructure. Each MITRE TTP entry contains an implementation example from a real-world malware sample.
How to Use It:
- Search by Indicator: Enter any suspicious URL, domain, IP, or hash into TI Lookup.
- Review Contextual Data: Examine related threat names, IP addresses, hashes, and event details.
- Explore TTP Implementations: View real-world examples of how specific MITRE ATT&CK techniques are implemented in actual attacks.
- Create Suricata Rules: Use extracted patterns to build network detection rules for IDS/IPS deployment:
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"Phishing Redirect Detected"; flow:established,to_client; content:"window.location"; http_server_body; content:"credential"; http_server_body; sid:1000001; rev:1;)
- Track Campaigns: Use TI Lookup to assess the scale of an attack campaign and develop resilient detections based on attacker tooling and page artifacts.
What Undercode Say:
- Browser-Level Visibility Is the New Battleground: Traditional URL analysis tools that rely on static scanning or network logs alone are fundamentally blind to modern phishing tactics. In-browser data inspection represents a paradigm shift—moving from “what the network saw” to “what the victim actually experienced.” This is not an incremental improvement; it’s a necessary evolution for any SOC serious about phishing detection.
-
Automation Without Sacrificing Context: The ability to automate URL analysis through SDK and API integrations—while preserving full browser-level evidence—is the key to scaling security operations. Tier 1 analysts can now validate threats independently, reducing unnecessary escalations by up to 20% and freeing senior analysts for high-impact hunting. The complete evidence package ensures that when escalation does occur, Tier 2 analysts receive actionable intelligence rather than disconnected indicators.
Analysis: The operational impact of in-browser data inspection extends beyond faster triage. By providing immediate access to DOM changes, redirect chains, and rendered page content, this capability fundamentally changes how detection engineering is performed. Instead of guessing at attacker behavior based on network artifacts, analysts can build YARA rules and Suricata signatures directly from observed browser-level attack patterns. The result is stronger, more resilient detections that adapt to evolving phishing tactics. For MSSPs managing multiple client environments, the ability to standardize URL analysis workflows and produce consistent, SOC-ready reports translates directly into improved service quality and reduced operational overhead.
Prediction:
- +1 Organizations that adopt browser-level visibility solutions will see phishing MTTR decrease by 40-60% within the first six months, as Tier 1 analysts gain the confidence to triage and close alerts independently without escalating to senior staff.
-
+1 The integration of in-browser data inspection with SOAR platforms will become a baseline requirement for SOC modernization by 2027, as security teams recognize that static URL analysis is no longer sufficient for detecting multi-stage, dynamic phishing campaigns.
-
-1 Organizations that fail to upgrade their URL analysis workflows will experience increased alert fatigue and analyst burnout, as Tier 1 analysts continue to escalate uncertain cases and Tier 2 analysts spend excessive time manually reconstructing attack chains from fragmented data sources.
-
-1 Attackers will increasingly leverage browser-based evasion techniques—including CAPTCHA-protected phishing pages, QR code redirection, and dynamic content injection—to bypass static analysis tools, widening the visibility gap for unprepared SOCs.
-
+1 The democratization of browser-level threat intelligence—through platforms like ANY.RUN that aggregate data from 600,000+ analysts—will enable smaller security teams to hunt like enterprise-grade SOCs, leveling the playing field against sophisticated threat actors.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=0RbP9dU_ibw
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Give Your – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
