Question

A SOC analyst is investigating a reported phishing email that contains no attachment but includes an embedded hyperlink pointing to a URL-shortened address. Corporate policy prohibits analysts from clicking suspicious links from their production workstations. After preserving the original message and extracting the URL, what is the MOST appropriate next step to safely determine whether the link is malicious?

Accepted Answer

Detonate the URL in an isolated sandbox or URL analysis service to observe the resulting behavior and any redirect chain

Answer

Reply to the sender asking them to confirm whether the link is legitimate before proceeding

Answer

Add the shortened domain to the email gateway blocklist and immediately close the case as resolved

Answer

Open the link in an incognito browser window on the production workstation to avoid saving cookies