Microsoft ATP Safelinks Decoding

[RyanDFIR]

Description
Some Microsoft products rewrite links to go through their scanning engine. Extracting the destination URL is simple enough, but it looks like there's more interesting stuff in the link as well.

Examples

• https://nam02.safelinks.protection.outlook.com/?url=https://dfir.blog/unfurl&data=02|01|abc@example.com|redacted&sdata=om5tJuXTaeMuWKSxdMvR9uSiZLTcvszo7g6bYJH65QE=&reserved=0

References

• Safe Links in Microsoft Defender for Office 365