Here’s what your team can put to work this month: full browser-level visibility for every URL analysis, a no-code path to embed ANY.RUN in Torq playbooks, and over 1,100 new detections across behavior signatures, Suricata rules, and YARA rules. 

Product Updates 

June’s releases focus on closing the visibility gap in phishing investigations and giving SOC and MSSP teams a faster route from alert to automated response. The headline update is in-browser data inspection, a new investigation layer in the Interactive Sandbox, alongside a new integration with the Torq AI SOC Platform. 

Closing the Phishing Blind Spot with In-Browser Data Inspection

Modern phishing campaigns rarely stop at a malicious URL. They rely on dynamic content, JavaScript, multi-stage redirects, credential harvesting forms, and browser-based tricks that often remain invisible to traditional analysis methods. 

This month, ANY.RUN introduced In-Browser Data Inspection, a new capability that captures browser-rendered content during URL analysis, revealing exactly what users would experience when interacting with a suspicious website. 

Instead of relying solely on page source or network data, analysts can now inspect: 

• Fully rendered web pages and dynamic content; 
• Phishing forms and credential collection attempts; 
• Client-side JavaScript execution; 
• Redirect chains and browser behavior; 
• Hidden elements designed to evade detection.

For SOC analysts, this means fewer blind spots during phishing investigations and faster validation of suspicious URLs. 

For security managers and CISOs, it means higher confidence in phishing detection, quicker incident triage, and better protection against increasingly sophisticated browser-based attacks. 

Scaling Triage and Response with the ANY.RUN & Torq Integration

Alert volume keeps growing faster than SOC headcount, and every alert that lands without context costs an analyst time they don’t have. ANY.RUN’s new integration with the Torq AI SOC Platform puts conclusive malware and phishing verdicts directly into the automated workflows teams already build in Torq: no custom code, no months-long rollout. 

The integration ships with five ready-to-use Torq HyperAgents covering two workflow types: case-based templates that pull observables straight from an open Torq case for enrichment, and standalone sandbox workflows that accept a URL or file as input and return a full verdict, IOC list, and report link anywhere in a custom automation chain. Results — reputation data, threat names, tags, and structured JSON — land directly in Torq Case Management, ready to branch on. 

Teams integrating ANY.RUN into Torq gain: 

• Faster incident resolution, with an average MTTR reduction of 21 minutes per case. 
• Operational scaling without added headcount, as HyperAgents absorb routine Tier 1 enrichment work. 
• Zero development overhead, with a no-code setup that’s live in minutes rather than months. 
• Standardized investigation logic, so every alert is checked against the same high-fidelity criteria regardless of analyst experience. 
• Higher ROI on existing tools, as ANY.RUN enriches the SIEM, EDR, and XDR data already flowing into Torq. 

The integration is available on ANY.RUN Threat Intelligence and Interactive Sandbox plans with API access, giving SOC and MSSP teams a direct path to scale triage and response without scaling the team itself. 

Threat Coverage Updates

Keeping pace with evolving malware remains a core priority for our detection team. During June, we significantly expanded threat coverage with:

• 1,055 new Suricata rules,
• 65 new behavior signatures,
• 14 new YARA rules.

These additions improve detection across network traffic, behavioral activity, and malware samples, helping analysts identify emerging threats faster while increasing investigation accuracy. The continuous expansion of detection logic also strengthens the quality of intelligence powering ANY.RUN’s Interactive Sandbox and Threat Intelligence solutions.

New Behavior Signatures

The 65 new behavior signatures added this month target malware-specific activity helping analysts confirm what a sample actually does inside the sandbox, rather than inferring it from static traits alone. Coverage this month spans commodity stealers and loaders, RATs, and ransomware families active across recent phishing and malvertising campaigns.

Highlighted detections include: 

New Suricata Rules

A total of 1,055 new Suricata rules were implemented in June to improve visibility into malicious network activity, including:

• Phishing Redirect Engine related URL (sid: 89003883) – Identifies various PhaaS operators’ infrastructure used as routing layer, delivering victim to specific phishkit landing pages.
• Adobe-themed RMM phishing (sid: 84003399) – Tracks attempts to lure user into installing remote management tool, disguised as shared secure documents.
• SilentNet CnC HTTP activity (sid: 84003444) – Detects SilentNet attempts to communicate with its C2-server.

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps businesses and organizations strengthen security operations with faster threat understanding andclearer evidence for response.

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, as well as Threat Intelligence solutions built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, detect active threats earlier, and support investigation and response workflows with relevant context.

ANY.RUN is SOC 2 Type II attested, reflecting its strong security controls and commitment to protecting customer data. For SOCs, MSSPs, and enterprise teams, the platform helps reduce investigationuncertainty, improve triage speed, and turn threat analysis into actionable insights for faster, better-informed decisions.

Integrate ANY.RUN into your SOC workflow → 

The post Release Notes: In-Browser Data Inspection, Torq Integration, and 1,100+ Threat Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.

By introducing behavioral sandboxing and threat intelligence, the company made triage 2x faster, achieved an MTTD of 20 seconds, improved MTTR and detection, and analyzed hundreds of supplier files every week without adding headcount.

A US Automotive Manufacturer Built Around a Large Supplier Ecosystem 

The company is a US-based automotive manufacturer operating within a highly interconnected supply chain. Its daily operations depend on continuous collaboration with more than 200 active vendors and third-party contractors. 

These external partners regularly exchange files with the organization to support ongoing manufacturing, technical, and business processes. This makes supplier communication essential to keeping operations moving, but it also creates a large and constantly changing entry point for risk. 

The SOC is responsible for protecting the company’s environment while ensuring legitimate supplier activity is not delayed. As the volume of incoming files grew, the team needed a way to analyzesubmissions consistently, improve detection and response speed, and reduce third-party exposure without increasing staffing costs. 

The Challenge: Supplier Files Were Entering Without a Consistent Analysis Process 

Before ANY.RUN, the company had no systematic process for analyzing files received from vendors and third-party contractors. 

Existing security controls could flag a submission as suspicious, but they did not always show what the file would actually do after execution. Without behavioral evidence, analysts were left with incomplete indicators and uncertain verdicts.

This created several problems for the SOC:

A Security Gap in Supplier File Intake 

Files could enter the environment without passing through a dedicated behavioral analysis layer.

This limited the company’s ability to identify threats that appeared harmless during static inspection but revealed malicious activity only after execution.

The risk was especially significant in a large supplier ecosystem. A compromised vendor account or mailbox could turn a trusted communication channel into an indirect route into the organization. With more than 47% of attacks on manufacturing companies originating from email, supplier messages and attachments represented a critical part of the company’s third-party attack surface.

High Escalation Rates 

Tier 1 analysts often lacked enough context to confidently close suspicious submissions. 

As a result, the majority of these files were escalated to more experienced analysts. Senior team members had to spend time reviewing cases that could have been resolved earlier with clearer evidence. 

Rising Investigation Costs 

The supplier network continued to generate a high volume of files. Handling that growth through manual investigation would have required more analyst hours and, eventually, additional headcount. 

Without a more scalable process, the company risked paying more just to maintain the same level of protection.

This pressure is especially high in manufacturing, where SOC teams carry an average workload 18% higher than security teams in other industries. For companies managing large supplier ecosystems, that makes manual investigation increasingly difficult to sustain.

Longer Exposure to Potential Threats 

Every delay in validating a suspicious file extended the period during which the organization could not confidently allow, block, or contain it. 

In a manufacturing environment, a missed threat can affect more than an individual endpoint. It can disrupt operations, expose sensitive data, and weaken trust across the supplier network. 

Building a Scalable Supplier File Triage and Analysis Process with ANY.RUN 

The manufacturer introduced a consistent process for analyzing files received from vendors and third-party contractors. 

By combining behavioral analysis with threat intelligence, the SOC gained both the evidence needed to understand what a file does and the context required to assess the wider threat behind it. 

Instead of relying on isolated alerts or incomplete indicators, analysts could detect malicious submissions more accurately, reach verdicts faster, resolve more cases at Tier 1, and reduce the amount of senior analyst time spent on routine reviews. 

This improved detection quality while contributing to lower MTTD and MTTR across supplier-related investigations. 

Reaching Faster Verdicts with Behavioral Evidence 

The SOC reduced triage time by giving analysts direct visibility into what suspicious supplier files did after execution. 

Files were safely analyzed in ANY.RUN’s cloud-based Interactive Sandbox, where the team could review process activity, network connections, system changes, commands, and other behavior without exposing the production environment. 

This replaced incomplete indicators with clear evidence of whether a submission was malicious and how it could affect the business. 

Structured and visual results also helped Tier 1 analysts move from alert to verdict with fewer manual checks. Instead of reconstructing file behavior across disconnected tools, they could validatesuspicious submissions faster and make more confident decisions. 

The faster path from alert to confirmed verdict contributed to improved MTTD, while clearer evidence and fewer repeated checks helped reduce MTTR. 

Connecting Supplier Files to Wider Threat Activity 

Behavioral analysis showed the team what each suspicious file did. Threat intelligence helped reveal whether the submission was connected to a larger risk.

Indicators uncovered during analysis could be linked to malicious infrastructure, related samples, known campaigns, and attacker activity. This gave analysts a clearer view of whether they were dealing with an isolated file or broader activity involving the company’s supplier ecosystem. 

The SOC also used this context to uncover additional indicators and behavioral patterns, strengthening internal detection controls beyond the original submission.

As a result, each investigation contributed to wider threat visibility. The team could resolve the immediate case while also identifying related activity that might otherwise remain hidden across the supply chain. 

Resolving More Supplier Files at Tier 1 

Before ANY.RUN, suspicious supplier files often moved up the escalation chain because Tier 1 analysts lacked enough evidence to confidently determine whether they were safe or malicious. 

With behavioral analysis, threat intelligence, and structured Tier 1 Reports available in the same workflow, first-line analysts received clearer summaries of each case, along with practical recommendations for the next step. 

This reduced the need to interpret every technical detail manually and helped analysts reach decisions faster. The company recorded a significant reduction in Tier 1 escalations, while Tier 2 received fewer low-context cases. 

The change reduced duplicated work and made better use of specialist expertise. Senior analysts spent less time repeating initial validation and more time investigating complex or high-impact threats. 

More supplier files were resolved at the right level the first time, helping investigation queues move faster and lowering the cost of each case. 

Analyzing Hundreds of Files Without Adding Headcount 

The company now analyzes hundreds of supplier files every week without hiring additional analysts.

For the business, this is one of the clearest returns from the new process. The manufacturer increased its triage and analysis capacity while keeping staffing costs stable. 

Instead of treating headcount growth as the only solution to rising file volumes, the company gave its existing team a faster and more consistent way to detect malicious activity and reach verdicts. 

The SOC now absorbs more supplier activity without creating the same increase in labor costs or investigation backlogs. 

This also gives the company a more sustainable foundation for growth. As the vendor network expands or file volume rises, the security team has a triage process that can scale with it. 

Improving MTTD and MTTR with 2x Faster Triage 

The manufacturer achieved a 2x improvement in alert processing and threat analysis speed, contributing to lower mean time to detect and mean time to respond. 

Suspicious supplier files moved through triage twice as fast. Analysts identified malicious behavior sooner, reached confirmed verdicts with less delay, and passed high-risk cases into response with clearer evidence already collected.

Legitimate submissions were also cleared faster, reducing the time business teams spent waiting for a security decision. 

This faster process also reduced the company’s exposure window. Analysts reached evidence-backed verdicts sooner without sacrificing investigation depth, helping the SOC protect operations while keeping supplier workflows moving. 

A Practical Model for Manufacturing Leaders Managing Third-Party Risk 

For manufacturing leaders, supplier security is not only a SOC issue. It affects operational continuity, staffing costs, executive accountability, and the company’s ability to grow without increasing exposure. 

A scalable approach should combine consistent file validation, broader threat context, and measurable outcomes. 

Turn Supplier File Intake into a Defined Risk Control 

A consistent triage helps the SOC apply the same standard to files received from vendors and contractors. 

With behavioral evidence from the Interactive Sandbox and additional context from Threat Intelligence, teams can replace inconsistent manual checks with a repeatable validation workflow.

For leadership, this creates clearer oversight of one of the company’s most exposed third-party risk channels. 

Increase Capacity Without Matching Growth with Headcount 

Faster verdicts and fewer unnecessary escalations allow the existing team to handle more supplier submissions. 

ANY.RUN reduces duplicated work, protects senior analyst capacity, and helps the SOC process higher file volumes without expanding at the same rate. 

The result is lower investigation cost and greater value from existing security resources. 

Protect Operations Without Slowing Supplier Activity 

Suspicious files can be analyzed in a controlled environment before they reach internal systems, while legitimate submissions move through review faster. 

This helps reduce the risk of supplier-borne threats without creating unnecessary delays for manufacturing, procurement, engineering, or other teams that depend on third-party collaboration. 

Connect Individual Submissions to Wider Exposure 

A suspicious file may be only one part of a larger campaign. 

ANY.RUN’s Threat Intelligence solutions help teams connect indicators to known infrastructure, related samples, active campaigns, and broader attacker activity. 

This gives leadership a clearer view of whether the company is dealing with an isolated submission or wider exposure involving suppliers and other external partners. 

Demonstrate Measurable Business Value 

The strongest supplier security programs are measured by outcomes, not by the number of files processed. 

With ANY.RUN, organizations can track improvements such as lower MTTD and MTTR, higher detection rates, fewer Tier 1 escalations, greater analysis capacity, and shorter exposure windows. 

These results make it easier to show how supplier security investments reduce risk, avoid additional staffing costs, and support business growth. 

Conclusion 

For this US automotive manufacturer, supplier file intake had become both a security risk and a growing cost center. More than 200 vendors were sending files into the environment, while analysts lacked a consistent way to validate behavior, add threat context, and reach fast decisions.

With ANY.RUN, the company built a scalable triage process that now supports hundreds of supplier files every week without additional headcount. Threat analysis became 2x faster, MTTD and MTTR improved, detection increased, and fewer cases required Tier 2 escalation. 

The result is a stronger security model for a complex supplier ecosystem: lower third-party exposure, better use of analyst time, and faster decisions that keep business operations moving. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate cyber threats faster and make evidence-based security decisions. 

Its cloud-based Interactive Sandbox enables teams to safely analyze suspicious files, URLs, and emails in real time, observe malicious behavior as it unfolds, and collect clear evidence for triage and response.

ANY.RUN’s Threat Intelligence solutions provide additional context around indicators, malicious infrastructure, emerging campaigns, and attacker activity. Together, these capabilities help organizations improve threat detection, reduce investigation time, and manage growing security demands without adding unnecessary operational costs. 

The post Closing the Supplier Security Gap: How a US Manufacturer Cut Third-Party Risk and Doubled SOC Triage Speed appeared first on ANY.RUN's Cybersecurity Blog.

The result for your team is faster incident resolution, reduced alert fatigue, and proactive threat detection. 

ANY.RUN & Torq Integration 

Unlike legacy SOAR approaches that often require custom code and months of implementation, Torq allows SOC and MSSP teams to build response logic visually. The ANY.RUN integration adds a critical layer of malware analysis, phishing detection, and IOC enrichment to these workflows. 

ANY.RUN users have access to five ready-to-use Torq HyperAgents designed to accelerate time-to-verdict:

• Threat Intelligence Enrichment with TI Lookup 

• File & URL Analysis with Interactive Sandbox 

Results, including reputation data, threat names, tags, and structured JSON responses, are delivered directly into Torq Case Management. Teams can edit the current templates to fit their specific processes, adding actions, changing conditions, or using ANY.RUN as one specific step in a complex, multi-tool automation. 

Available on ANY.RUN Threat Intelligence and Interactive Sandbox plans with API access, the integration helps analysts streamline their workflows, gaining full alert or threat context quickly with an average reduction in MTTR of 21 minutes.  

Interactive Sandbox Templates in Torq 

The Interactive Sandbox workflows allow analysts to detonate suspicious objects in real-time environments (Windows, Linux, macOS or Android) to uncover evasive behaviors. There are two types of templates available for sandbox analysis: 

1. Case-Based Workflows 

These are triggered directly from a Torq Case, where observables and attachments are automatically ingested from sources like EDR, SIEM, XDR, or email security tools. 

• Process: The analyst opens a case and launches the workflow. The system automatically retrieves observables or attachments, filtering for supported objects such as URLs or files. Analysts can then select specific objects for detonation. 

• Result: Analysis data is added to the case notes in real-time. This includes a brief context, reputation, threat names or tags, and a structured JSON response. Additionally, a direct link is provided, allowing the analyst to jump into the ANY.RUN session to continue a manual, interactive analysis. 

The list of case-based templates: 

• Enrich Case with URL Analysis in ANY.RUN Sandbox 

• Enrich Case with File Analysis in ANY.RUN Sandbox 

2. Sandbox Analysis Workflows 

These templates are designed to be embedded as a specific step within a larger, custom incident response flow. 

• Process: Unlike case-based templates, these function independently of a specific case. They accept a URL or File as an input parameter and initiate the ANY.RUN Sandbox analysis. 

• Result: The workflow waits for the analysis to complete and returns a structured JSON object containing the final verdict, analysis metadata, a list of IOCs, and a link to the full report. This data can then be passed further down the custom automation chain. 

The list of sandbox analysis templates: 

• Analyze URLs with ANY.RUN Sandbox 

• Analyze Files with ANY.RUN Sandbox 

Threat Intelligence Lookup Templates in Torq 

The Threat Intelligence (TI) Lookup integration focuses on rapid enrichment of “raw” observables found in alerts, such as IPs, domains, hashes, and URLs. 

• Automation at Scale: When a case contains suspicious indicators, the TI Lookup workflow queries ANY.RUN’s vast database of threat data—continuously updated from millions of sandbox sessions. 

• Instant Context: The workflow returns high-fidelity data including the reputation of the indicator, threat names, and specific tags. This allows analysts to immediately understand the nature of a threat and decide whether to block the indicator or escalate the incident. 

• Enrichment Integration: Much like the sandbox workflows, TI Lookup results are delivered directly into the Torq interface as JSON data or case notes, ensuring that the analyst never has to leave their primary workspace to gather intelligence. 

Explore the TI Lookup template. 

How to Integrate ANY.RUN in Torq 

Setting up the integration is straightforward and requires no custom coding: 

1. Navigate to Integrations within Torq and locate ANY.RUN. 

2. Click Add, create a new instance, and enter your API key. 

3. Go to the Templates tab and search for ANY.RUN templates. 

4. Select your previously configured ANY.RUN integration to begin using the workflows. 

By default, these playbooks are configured to be launched manually. This is a deliberate design choice to ensure that only appropriate objects are sent for analysis.  

However, for high-volume environments, these templates can be easily integrated into broader, fully automated playbooks. 

Key SOC & MSSP Benefits of Integrating ANY.RUN in Torq 

ANY.RUN’s deep behavioral visibility with Torq’s hyper-automated orchestration levels up the efficiency of modern security operations, moving beyond simple automation toward maximizing security ROI. 

• Faster incident resolution (MTTR): Automating sandbox analysis and threat intelligence correlation allows you to cut incident resolution time by tens of percent. Analysts get clear verdicts in seconds, enabling them to block threats before they spread. 

• Operational Scaling: Teams can handle a growing volume of alerts with Torq HyperAgents & handling routine Tier 1 tasks, allowing analysts to focus on complex threats without increasing headcount.

• Zero development overhead: Unlike custom integrations that require months of engineering, this no-code setup is ready in minutes. You get a functional automation foundation without the cost of writing or maintaining scripts. 

• Standardized investigation logic: Every alert is checked using the same high-fidelity criteria. This ensures consistent results and reduces the risk of human error, regardless of an analyst’s experience level. 

• Higher ROI on existing tools: ANY.RUN works as an enrichment layer inside Torq, making your SIEM, EDR, and other security investments more effective by providing them with immediate, actionable context. 

• Reduced analyst burnout: By eliminating manual data entry and constant switching between tools, you allow your team to focus on meaningful security work, which improves overall SOC productivity. 

About ANY.RUN 

Trusted by over 600,000 cybersecurity professionals and 15,000+ organizations worldwide, ANY.RUN helps security teams investigate threats faster and with greater accuracy. 

Our Interactive Sandbox accelerates incident response by allowing you to analyze suspicious files in real time, while our Threat Intelligence solutions (TI Lookup and TI Feeds) provide the necessary context to anticipate and stop today’s most advanced attacks. 

The integration of ANY.RUN with Torq adds a specialized layer of malware analysis, phishing detection, and IOC enrichment to your security operations. By utilizing these automated workflows, SOC teams can seamlessly embed ANY.RUN’s deep visibility into their existing triage and incident response flows. 

The post ANY.RUN & Torq Integration: Scale Triage & Respond with Confidence appeared first on ANY.RUN's Cybersecurity Blog.

It struggles because every alert creates work: validate the indicator, understand the behavior, check whether the threat is known, determine its scope, decide whether to escalate, contain the incident, and make sure the same attack is easier to detect next time.

When these steps depend on disconnected tools, analysts lose time moving between dashboards, manually enriching IOCs, recreating investigations for senior analysts, and searching for context that should already be available. The SOC becomes a relay race in which every handoff drops a few pieces of evidence.

This is the hidden cost of fragmented security operations. It increases alert fatigue, slows response, creates unnecessary escalations, and leaves experienced analysts handling routine investigations that could have been resolved earlier.

Key Takeaways

• A SOC needs connected intelligence, not just more alerts. Fragmented tools force analysts to manually collect context, repeat investigations, and lose evidence during handoffs.
• Threat Intelligence Feeds strengthen monitoring from the start. Fresh indicators and malicious infrastructure context help teams prioritize alerts and identify active threats faster.
• Interactive Sandbox analysis provides behavioral proof. Analysts can safely investigate suspicious files, URLs, scripts, and archives instead of relying only on static verdicts.
• In-browser data inspection helps expose evasive phishing. SOC teams can observe dynamically loaded content, injected forms, redirects, scripts, and credential collection behavior that static URL scans may miss.
• Threat Intelligence Lookup turns isolated artifacts into investigation pivots. Analysts can enrich IOCs, IOBs, and IOAs, connect them to related samples and infrastructure, and access the full sandbox analysis behind an indicator.
• Structured reporting speeds up response and escalation. Tier 1 Reports preserve investigation evidence and give Tier 2, Tier 3, and incident response teams a clearer starting point.
• Threat hunting and detection engineering improve the entire SOC loop. Behavioral searches, Threat Intelligence Reports, and YARA Search help teams find activity that alerts miss and convert investigation findings into stronger detections.

What Changes When Intelligence Is Connected

When detection, triage, response, and hunting instead run as one continuous, intelligence-fed process, every stage strengthens the next:

• Noise gets filtered early. Live feeds rule out known threats before they consume analyst time.
• Investigations move faster. Interactive analysis reveals hidden behavior in real time instead of waiting on static reports.
• Decisions are backed by context. A single indicator connects to millions of past analyses, turning isolated alerts into recognizable patterns.
• Escalations carry evidence, not guesswork. Findings move between tiers as structured, decision-ready intelligence rather than raw technical data.

This is what it looks like to operationalize threat intelligence across the full SOC workflow — not as a bolt-on lookup tool, but as the connective layer underneath monitoring, triage, response, and detection engineering. Below is how ANY.RUN’s Threat Intelligence suite — Threat Intelligence Feeds, Threat Intelligence Lookup, and Interactive Sandbox — fuels each stage.

1. Monitoring: Prioritize What Matters with Threat Intelligence Feeds 

The first challenge in any SOC is deciding which alerts deserve attention at all. With live IOC streams collected from a global analyst community, ANY.RUN’s Threat Intelligence Feeds work as that early filter. Analysts and automated systems see instantly whether an IP, domain, or an URL has already been confirmed malicious, ruling out duplicates before they ever reach a human queue. 

Every indicator in the feed is actionable and connected back to a sandbox analysis, so monitoring systems aren’t just receiving a red flag. They’re inheriting the behavioral evidence behind it. That context is what separates a feed analysts trust from one they learn to ignore. 

TI Feeds are delivered in multiple formats with straightforward integration paths into SIEM, TIP, and SOAR platforms. The filtering happens automatically, at the point of ingestion — not after an analyst has already spent time on a case that should have been ruled out in milliseconds. 

For monitoring specifically, this means: 

• Continuously updated indicators feeding directly into existing detection stacks; 
• Fewer duplicate or already-confirmed alerts reaching the human queue;  
• A baseline of global telemetry that flags infrastructure before it’s used against your organization. 

Threat Intelligence Feeds help teams: 

• identify known malicious infrastructure earlier; 
• enrich alerts automatically; 
• prioritize events connected to active malware or phishing campaigns; 
• update blocklists and detection logic with fresh data; 
• reduce time spent manually checking external threat intelligence sources; 
• improve correlation between internal telemetry and current attacker activity. 

This gives analysts a better starting point. Instead of beginning every investigation with “What is this indicator?”, they can begin with “How urgent is this, and what attack activity is it connected to?” 

2. Triage: Validate Alerts with Behavioral and Historical Context 

Triage is the decision point that determines whether an alert becomes a closed ticket, an escalation, or a full incident. For Tier 1 analysts, the goal is not to perform a complete forensic investigation for every event. It is to quickly determine whether the object is malicious, understand enough of its behavior to assess risk, and provide evidence for the next action. 

ANY.RUN supports this process through two connected capabilities: 

• Interactive analysis of suspicious files and URLs in the Sandbox; 
• Context enrichment through Threat Intelligence Lookup. 

ANY.RUN’s Interactive Sandbox allows analysts to detonate suspicious files, scripts, archives, and URLs in an isolated environment and observe their behavior in real time. The Sandbox gives analysts the proof behind the alert. It transforms a suspicious file or URL from an unknown object into an observable attack chain. 

ANY.RUN’s Threat Intelligence Feeds come in multiple formats with simple integration options, making it easy to plug into your existing SIEM, TIP, or SOAR setup. 

Detect evasive phishing with in-browser data inspection

Phishing analysis creates specific challenge. A suspicious page may look harmless to an automated scanner but reveal credential theft behavior only after a user interacts with it. 

ANY.RUN’s in-browser data inspection helps analysts examine phishing pages from inside the browser session. It provides visibility into dynamically loaded content, injected forms, script execution, redirect chains, and network activity. 

This makes it easier to investigate phishing pages that: 

• imitate trusted login portals; 
• load malicious content only after interaction; 
• use hidden or dynamically injected credential forms; 
• redirect victims through multiple pages; 
• send submitted credentials to attacker-controlled infrastructure; 
• use browser-side scripts to evade static URL analysis. 

In practice, this gives triage analysts: 

• A complete execution tree from the initial URL to the final rendered page, with detection-triggering stages highlighted. 
• HTTP request-level visibility into the full redirect chain, useful for both validation and later detection engineering. 
• An HTML DOM Changes view showing exactly what code was injected after the page loaded — revealing what static analysis structurally cannot see. 
• A dedicated Indicators tab collecting every URL, domain, IP, and content hash tied to the analyzed page, ready for pivoting. 

Because this evidence is collected and correlated within a single workflow, junior analysts can validate suspicious URLs with far more confidence — and far less escalation by default — while still capturing everything a senior analyst or detection engineer would need later. 

Enrich Indicators with Behavior and Context

A sandbox session explains what one suspicious object does. Threat Intelligence Lookup helps analysts understand whether it is part of something larger. 

Threat Intelligence Lookup is designed as a searchable repository of indicators and event data extracted from interactive sandbox sessions, with direct access to the related analysis when an indicator is found. 

This includes: 

• IOCs: hashes, IP addresses, domains, URLs, file names, and registry artifacts; 
• IOBs: mutexes, command lines, process behavior, dropped files, loaded modules, and network patterns; 
• IOAs: attacker techniques and attack chains, including persistence, credential theft, lateral movement-related behavior, and command-and-control activity. 

The distinction matters because attackers can rotate static IOCs quickly. A hash may change after a minor rebuild. A domain may disappear after a few hours. But behavioral patterns, execution logic, mutexes, registry modifications, and process chains can provide more durable clues for investigation. 

With Threat Intelligence Lookup, an analyst can start with one artifact from an alert and pivot into related activity: 

• Search a suspicious domain and find associated phishing pages; 
• Search a hash and identify related malware families; 
• Search a mutex or command line and discover additional samples using the same behavior; 
• Search a destination IP and identify connected command-and-control infrastructure; 
• Search MITRE ATT&CK techniques to investigate samples exhibiting a particular behavior; 
• Open linked sandbox sessions to review the full attack chain behind an indicator. 

3. Response: Turn Investigation Evidence into Faster Action

Once an alert is confirmed, the SOC needs to decide what to do next.

Containment may involve blocking infrastructure, isolating an endpoint, resetting credentials, removing malicious files, investigating related hosts, or escalating to incident response. These actions depend on understanding more than a single IOC.

A domain may be one part of a phishing kit. A file hash may be one stage of a multi-step infection chain. A suspicious process may have created persistence, downloaded another payload, or contacted infrastructure that should also be blocked.

Connect Threat Intelligence Lookup to Full Sandbox Analysis

The combination of Threat Intelligence Lookup and Interactive Sandbox creates a direct path from an indicator to the evidence behind it. 

An analyst can begin with a suspicious hash, URL, domain, IP address, mutex, process name, registry key, or command line in Threat Intelligence Lookup. From there, they can access linked sandbox sessions and inspect the complete behavioral analysis. 

This lets response teams determine: 

• how the threat entered the environment; 
• what processes and scripts it launched; 
• what files it created or modified; 
• whether it established persistence; 
• which infrastructure it contacted; 
• whether it attempted credential theft or data exfiltration; 
• what additional indicators should be blocked or investigated; 
• which MITRE ATT&CK techniques are relevant to containment and remediation. 

This connection reduces the risk of narrow response actions, such as blocking one visible domain while missing related infrastructure, secondary payloads, or persistence mechanisms. 

Use Tier 1 Reports for Escalation and Case Handoffs

A SOC investigation often loses momentum at the escalation stage. 

Tier 1 analysts may identify suspicious behavior, but Tier 2, Tier 3, or incident response teams frequently receive a mixture of screenshots, raw logs, copied IOCs, and incomplete notes. The receiving analyst then has to reconstruct the investigation before taking action. 

Tier 1 Reports help standardize this handoff. They package the findings of a sandbox analysis into a structured, decision-ready report that can support triage, escalation, incident response, and communication with stakeholders. 

A Tier 1 Report can include: 

• a verdict and threat classification; 
• an executive-friendly summary; 
• key IOCs; 
• observed behavior; 
• MITRE ATT&CK mapping; 
• process and network evidence; 
• recommended next steps for the investigation. 

This helps Tier 1 analysts explain why a case should be escalated. It also helps senior analysts begin from the evidence already collected instead of repeating routine validation work. 

4. Threat Hunting & Detection Engineering: Getting Ahead of the Next Alert

Monitoring, triage, and response all start with something that already happened — an alert, a submitted sample, an indicator. Threat hunting and detection engineering exist to get ahead of that: finding what alerts miss, and building detections that hold up against attackers who rotate infrastructure and rename their tools faster than static IOC lists can track. 

Threat hunters use hypotheses to search for suspicious behavior. Detection engineers turn those findings into rules, queries, signatures, and automated controls that strengthen future monitoring. 

ANY.RUN supports both workflows by giving analysts access to behavioral intelligence, campaign context, and a large corpus of real-world malware samples.

Hunt With Threat Intelligence Lookup 

Threat Intelligence Lookup supports hunting by allowing analysts to search for behavioral artifacts, not only static indicators. 

A threat hunter can begin with a suspicious mutex, file path, registry key, command line, destination IP, HTTP response pattern, or MITRE ATT&CK technique. From there, they can identify related malware samples, campaigns, and infrastructure. 

This supports key hunting challenges, such as: 

• tracking a malware family through stable behavioral artifacts; 
• investigating suspicious infrastructure observed in internal telemetry; 
• validating whether an alert pattern is connected to known malicious activity; 
• expanding one IOC into a campaign-level investigation; 
• identifying related indicators for retrospective searches; 
• reducing false positives by comparing an internal event with observed malware behavior. 

We cover this in depth — including hands-on examples of hypothesis validation against live phishing techniques, tracking entire malware families from a single mutex, and turning one alert into a full threat actor profile — in Intelligence-Driven Threat Hunting: How SOCs Find What Alerts Miss. 

Use Threat Intelligence Reports for Campaign-Level Awareness

Threat Intelligence Reports support a broader layer of SOC operations. 

While Tier 1 Reports focus on one specific suspicious object or incident, Threat Intelligence Reports provide analyst-led research into active threats, malware families, phishing campaigns, ransomware operations, threat actors, and emerging techniques. 

They can help teams: 

• prioritize threats relevant to their industry; 
• understand malware delivery methods and victimology; 
• identify likely attacker behaviors; 
• prepare response playbooks; 
• improve awareness among security and IT teams; 
• inform executive risk discussions; 
• guide detection and hunting priorities. 

For example, if a SOC sees a rise in suspicious activity associated with a particular malware family, a Threat Intelligence Report can help analysts understand the family’s common infection chain, persistence techniques, infrastructure patterns, and business impact. 

Validate Detections with YARA Search

Detection engineering is where investigation findings become long-term defensive value. 

Detection engineering lives or dies on whether a rule generalizes — whether it catches a malware family’s future builds, or breaks the moment the author changes a hardcoded string. TI Lookup’s YARA Search is where rules get validated before they ever reach production, run against an enormous corpus of real-world samples rather than a small internal test set. 

This implies a practical rule-development cycle: 

• Analyze a suspicious sample in the Sandbox; 
• Identify stable strings, code patterns, or structural characteristics; 
• Create an initial YARA rule; 
• Test the rule against real samples; 
• Review matches for accuracy and false positives; 
• Refine the rule; 
• Validate it again before deployment. 

This makes detection engineering less speculative. Instead of assuming a rule will work in production, teams can test it against real malware samples and identify where it is too narrow, too broad, or vulnerable to superficial attacker changes. 

Business Impact: A Connected SOC Instead of a Tool Collection

The business value of ANY.RUN is not simply access to more threat data. It is the ability to reduce friction between the workflows that determine whether a SOC can operate efficiently at scale.

The pattern across all four stages is the same: intelligence that’s connected to behavioral evidence, available at the moment a decision needs to be made, in a form the next person in the chain can use without redoing the work. That’s what turns threat intelligence from a reference lookup into infrastructure the entire SOC — and MSSPs running multiple environments — can scale on without proportionally scaling headcount.

Conclusion

A SOC doesn’t fail because analysts lack skill or because tools lack data. It strains under fragmentation — context lost between monitoring and triage, between triage and response, between a single finding and the durable detection it should have become.

ANY.RUN’s Threat Intelligence — TI Feeds, TI Lookup, and Interactive Sandbox, including in-browser data inspection, Tier 1 Reports, Threat Intelligence Reports, and YARA Search — closes the gaps by fueling every stage of the SOC workflow from the same connected source of evidence. Monitoring filters noise before it reaches a human. Triage turns alerts into verified, contextualized decisions. Response carries that evidence intact through every handoff. Hunting and detection engineering convert what was learned into coverage that holds before the next campaign even starts.

Finally, the strongest SOC workflows do not end when a ticket is closed. Every investigation should improve the next one.

Threat Intelligence Feeds strengthen monitoring. The Interactive Sandbox provides behavioral proof. In-browser data inspection helps expose evasive phishing. Threat Intelligence Lookup adds historical and campaign context. Tier 1 Reports improve escalation and response. Threat Intelligence Reports guide broader prioritization. YARA Search turns analysis into stronger detections.

Together, these capabilities create a continuous intelligence loop:

Monitor → prioritize → analyze → enrich → respond → hunt → improve detections → monitor better.

The result isn’t just faster individual investigations — it’s a SOC that compounds what it learns, case after case, instead of relearning the same threats from scratch every time they reappear under a new IP.

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate threats faster and make more confident security decisions. 

Its cloud-based Interactive Sandbox lets teams safely analyze suspicious files, URLs, and emails in real time, observe malicious behavior as it unfolds, and collect clear evidence for faster response. 

ANY.RUN’s Threat Intelligence solutions add broader context around threats, infrastructure, and attacker activity. Together, these capabilities support faster triage, stronger detection, better-informed response decisions, and more efficient security operations at scale. 

The post From Alert Enrichment to Confident Response: How ANY.RUN Powers Every SOC Workflow appeared first on ANY.RUN's Cybersecurity Blog.

As a result, static URL analysis may miss the most important part of the attack, leaving teams with incomplete evidence, slower triage, and longer exposure to a potential Microsoft 365 compromise. 

Full browser-level inspection closes this gap by revealing how the page behaves after execution in a dynamic environment. This gives teams the evidence they need to validate the threat and respond faster. 

Key Takeaways 

• EvilTokens hides key parts of its phishing flow behind browser-side decryption, creating a visibility gap for static URL analysis. 
• The kit abuses Microsoft’s legitimate device login flow to gain account access without directly stealing the victim’s password. 
• Browser-level evidence helps SOC teams reduce manual checks, avoid unnecessary escalations, and make faster containment decisions. 
• Threat Intelligence pivots connect one EvilTokens session to related phishing kits, infrastructure, indicators, and wider device-code phishing activity. 
• Decrypted code and behavioral patterns can also support stronger phishing signatures, threat hunting, and custom detection rules. 

EvilTokens Targeting: Regions and Industries at Risk 

According to ANY.RUN Threat Intelligence data, recent EvilTokens activity is concentrated mainly in the United States and Europe. 

View recent EvilTokens activity in ANY.RUN Threat Intelligence 

The kit has been observed targeting organizations in: 

• Managed security services 
• Technology 
• Manufacturing 
• Education
• Banking
• Consulting and financial services 

These findings show that EvilTokens is aimed largely at organizations where access to a single Microsoft 365 account can expose sensitive data, internal communications, and connected business services. 

Why EvilTokens Creates a Blind Spot for SOC Teams 

EvilTokens continues to rank among the most frequently observed phishing kits in ANY.RUN’s weekly threat reports. 

A recent analysis session showed how the kit uses Microsoft Device Code Phishing to compromise accounts without stealing credentials directly. Instead, it convinces the victim to complete Microsoft’s legitimate device login flow and unknowingly authorize access to their account. 

Check analysis session with recent EvilTokens attack 

What makes the attack difficult to investigate is the way it hides its phishing content. The landing page HTML is encrypted with AES-GCM and becomes visible only after the browser decrypts it and renders it in the DOM. 

Static URL checks and network-level detection may therefore capture the initial response without showing what the victim actually sees in the browser. This can leave SOC teams with an incomplete verdict, force additional manual checks, trigger unnecessary escalations, and delay containment.

This visibility gap becomes a business risk. When SOC teams cannot see what a suspicious page does after browser execution, the impact goes beyond a slower investigation. It can lead to: 

• Longer exposure to potential Microsoft 365 account takeover 
• Delayed containment and response decisions 
• More alerts escalated to senior security staff 
• Higher investigation workload and operational costs 
• Incomplete evidence for blocking related infrastructure 
• Greater risk of unauthorized access to corporate data and services 

To validate the threat quickly, teams need visibility into what happens after the page begins running. In the following walkthrough, we use ANY.RUN’s in-browser data inspection to uncover the decrypted page, trace the requests behind the device-code flow, and collect evidence for response and further detection. 

With in-browser data inspection inside ANY.RUN’s Interactive Sandbox, investigators can examine cases like this across several layers:

HTML DOM Changes: Tracks changes to the DOM over time and allows investigators to compare different snapshots of the same page. It highlights byte-level differences from the previous DOM state, making it easier to identify the exact moment when the decrypted phishing page appears. 

HTTP Requests: Provides visibility into browser-level network activity, including requests involving HTML, JavaScript, Fetch/XHR, scripts, static assets, binary files, archives, and other request categories. 

URL Details: Displays the final URL and domain, SSL certificate information, DNS A records, request statistics, and triggered detection signatures. 

Indicators: Collects indicators of compromise associated with the page, including top-level domains, subdomains, URL endpoints, file hashes, IP addresses, and ASN information. 

Triage Walkthrough Using Browser Data 

The network traffic shows that EvilTokens delivers the landing page in an HTTP response encrypted with AES-GCM: 

The decrypted HTML DOM of the page can be viewed in the Browser Data panel: 

Here, you can view snapshots of the DOM structure after the AES-GCM-encrypted code has been decrypted:

The HTML DOM Changes fields contain the following information: 

• Timeshift: The time elapsed from the start of the analysis when the DOM snapshot was captured. 

• Score: The risk level assigned to that particular state of the page. As shown in the screenshot, the score is 100, which corresponds to the signatures triggered by that DOM state. 

• Size diff: The change in DOM size compared with the previous snapshot. 

• Size: The size of the current DOM snapshot. 

• Page: The domain associated with the snapshot. 

The value that should draw your attention most is the green +48-byte size diff. By selecting the fourth snapshot, you can see which line was removed and which line was added compared with the previous snapshot: 

Looking at the Render panel on the left, we can confirm that a user code has appeared on the page. The attackers will later use this code to take over the victim’s Microsoft 365 account: 

This suggests that the landing page dynamically requested the user code from the backend through a Fetch/XHR request. The request can be examined in the HTTP Requests tab: 

By comparing the Timeshift values of the HTTP request and the DOM snapshot, we can conclude that the user code was obtained through a request to the /api/device/start endpoint. Clicking the URL confirms this:

Pivoting from One EvilTokens Session to Broader Threat Activity

The findings from a single analysis session can be used to uncover related phishing infrastructure and activity.

Start with URL Details, where the code exposed in the DOM triggered the Microsoft OAuth device-code phishing signature.  

Searching for this signature in ANY.RUN’s Threat Intelligence reveals other phishing resources that use similar code patterns:  

TI Query: ruleName:”^Microsoft OAuth device-code phishing has been detected$”

The results show that this behavior is not unique to EvilTokens. Other phishing kits use similar code and techniques, allowing teams to move beyond one isolated case and identify a broader set of related threats.

 To narrow the search specifically to EvilTokens, use the following query: threatName:”eviltokens” 

Threat Intelligence data shows that recent EvilTokens activity is concentrated mainly in the United States and Europe: 

Teams can also track device code phishing activity more broadly using the oauth-ms-phish threat tag:  

TI Query: threatName:”oauth-ms-phish” 

This wider search helps teams identify related campaigns even when they are associated with a different phishing kit or infrastructure.

Next, return to Browser Data and open the Indicators tab: 

Not every artifact collected during the analysis should be added to detection rules. For example, the observed IP address belongs to the CloudflareNet autonomous system. Blocking or detecting this shared infrastructure could produce false positives and affect legitimate services. 

More specific indicators from the session, including the domain, URI, and hash, are stronger candidates for further validation and detection: 

TI Query: url:”/api/device/start” or  domainName:”emp01825.workers.dev$” or md5:”fcd1b654a0b3e8f85ca7cfdafe494d4b” 

By pivoting on signatures, threat names, tags, and carefully selected IOCs, teams can connect an individual alert to wider phishing activity, improve detection coverage, and respond proactively to related attacks. 

Breaking Down the EvilTokens Attack Logic 

The HTML DOM Changes view is useful not only for triage but also for deeper code analysis. By examining the decrypted page logic, teams can identify recurring patterns that may support low-level phishing detection rules. 

The following code shows the Device Code Flow Configuration: 

Gate Check and Decoy Delivery 

The first fragment shows the client sending a gate check request to: 

/api/device/gate/<PAGE_ID> 

The backend returns a killed flag that determines what happens next. If the phishing flow remains active, the attack continues. Otherwise, the victim is shown a decoy page designed to resemble a Microsoft error or expired-link message. 

This mechanism allows operators to disable the phishing page or hide its true behavior when certain visitors or conditions are detected. 

Requesting and Displaying the User Code 

The next fragment sends a POST request to _startUrl: 

/api/device/start 

The backend returns the userCode, sessionId, and verification URI. The script then stores the session, constructs _verificationUrl, and writes the user code into the DOM for the victim. 

This is the same activity observed earlier in the HTTP Requests view, connecting the browser-side code directly to the network request and the user code displayed on the page. 

Monitoring the Device-Code Session 

The frontend then checks the status of the device-code session through: 

/api/device/status/{sessionId} 

It repeatedly sends GET requests containing the current sessionId and receives the latest status from the backend. 

Once the status changes to completed, the script stops polling, displays a success screen, and redirects the victim to the legitimate OneDrive website. 

This final redirect helps the attack appear successful and legitimate, while the attackers retain the access authorized through the completed Microsoft device login flow. 

By connecting the decrypted DOM code with browser requests and visible page changes, teams can reconstruct the full phishing logic and identify code patterns, endpoints, and behaviors that may strengthen future detection. 

Turning Hidden Browser Activity into Faster SOC Decisions 

The EvilTokens investigation shows the practical value of browser-level evidence. Instead of stopping at the encrypted HTTP response, teams can see the decrypted DOM, identify the request that generated the user code, trace the device-code session, and extract artifacts for detection and threat hunting. 

This improves the investigation workflow in several ways: 

Faster triage and fewer unnecessary escalations: Tier 1 analysts can validate suspicious URLs using direct browser-level evidence rather than relying on incomplete indicators. This reduces uncertainty, speeds up verdicts, and keeps more benign cases from reaching senior teams.

Smoother handoff and faster response: When escalation is necessary, Tier 2 receives the full attack context, including DOM changes, HTTP requests, triggered signatures, rendered content, and relevant indicators. This reduces repeated work and supports faster containment decisions. 

Stronger detection engineering: Decrypted page code, browser requests, endpoints, and behavioral patterns provide useful material for custom phishing signatures, hunting hypotheses, and detection rules based on observed attacker behavior. 

More focused threat hunting: Teams can pivot from one EvilTokens session to related domains, code patterns, phishing kits, and device-code attacks in ANY.RUN’s Threat Intelligence, expanding the investigation beyond a single URL. 

Clearer reporting: Structured investigation results turn complex browser activity into evidence that is easier to use during triage, escalation, incident response, and stakeholder communication.

For SOC and MSSP teams, this means less time spent reconstructing browser activity manually, better use of senior resources, and a faster path from a suspicious URL to a confident response decision. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate threats faster and make more confident security decisions. 

Its cloud-based Interactive Sandbox lets teams safely analyze suspicious files, URLs, and emails in real time, observe malicious behavior as it unfolds, and collect clear evidence for faster response. 

ANY.RUN’s Threat Intelligence solutions add broader context around threats, infrastructure, and attacker activity. Together, these capabilities support faster triage, stronger detection, better-informed response decisions, and more efficient security operations at scale. 

The post EvilTokens: How “Ghost” Code Threatens US and European Businesses appeared first on ANY.RUN's Cybersecurity Blog.

This award reflects our dedication to building solutions that make a real impact on daily security operations. 

At ANY.RUN, we help SOC and MSSP teams worldwide streamline threat investigation workflows through confident decision-making, full malware and phishing visibility, and actionable insights thataccelerate incident investigations and response. 

We thank our global community of security professionals for continuously trusting our solutions and supporting our growth! 

Reinforcing Our Position as a Market Leader 

The Cybersecurity Stars Awards are organized by The Hacker News, one of the industry’s leading cybersecurity publications, delivering industry news, threat intelligence insights, and practical security guidance to more than 50 million security professionals annually. 

The award recognizes companies and individuals who have demonstrated excellence in cybersecurity through innovation, impact, and technical achievement. 

As the organizers noted: 

“[ANY.RUN’s] work helps SOC and MSSP teams move faster in the critical moments when every second counts in threat investigation.” 

This recognition reflects our mission to simplify complex investigations and help security teams in companies and organizations accelerate detection, analysis, and response at scale. 

Delivering Innovation for Measurable Impact 

Winners were selected by an independent panel of cybersecurity experts based on criteria including innovation, industry impact, and technical excellence. At ANY.RUN, we translate these principles into tangible business outcomes for security teams: 

• Faster investigations through interactive, real-time analysis and threat hunting workflows. 

• Greater operational efficiency with automated enrichment and streamlined investigation processes. 

• Confident incident response backed by actionable intelligence from investigations by 15,000+ security teams. 

Recent Releases Driving SOC Investigations Forward 

ANY.RUN’s enterprise-ready solutions are designed to meet the needs of modern SOC and MSSP environments. Our recent releases reinforce this mission by delivering: 

• Fast, evidence-based decision-making through in-browser data inspection, enabling analysts to perform URL analysis without switching between multiple tools or workflows. 

• Consistent and efficient investigations with SOC-ready reporting that converts analysis outputs into structured, operationally ready documents. 

• Simplified security operations and faster response through cross-platform analysis across Windows, Linux, Android, and macOS VMs, allowing teams to investigate diverse threats within a single environment and workflow. 

About ANY.RUN 

ANY.RUN provides cybersecurity solutions for SOC and MSSP teams that enable stronger operations across threat investigation workflows.  

Interactive Sandbox for enterprise-scale malware and phishing analysis and ANY.RUN Threat Intelligence solutions aggregate investigation data from more than 15,000 SOCs worldwide to support instant enrichment and early threat detection.   

The company’s mission is to deliver fast threat understanding and confident incident response.  

ANY.RUN is SOC 2 Type II attested and committed to strong security control and customer data protection. 

The post The Hacker News Recognizes ANY.RUN as the Best Security Investigation Platform 2026  appeared first on ANY.RUN's Cybersecurity Blog.

That’s where alert triage comes in: the essential first step in detecting, prioritizing, and responding to threats efficiently. Done right, it defines the overall effectiveness of a SOC or MSSP and determines how well an organization can defend itself.

Spoiler Alert About Alerts 

Here’s your spoiler for today: good triage is not just about checking whether an IOC is malicious. It is about understanding what happened, how serious the threat is, and what action should come next. 

That becomes much easier when analysts have the right environment to safely analyze suspicious files, URLs, and emails, plus the threat intelligence needed to connect each finding to a wider campaign or infrastructure. 

ANY.RUN supports this process from the first alert to the final decision. Analysts can observe real behavior in the interactive sandbox, enrich findings with live threat context, inspect browser-level activity during phishing investigations, and turn the results into clear Tier 1 Reports for faster escalation or closure. 

The result is a stronger triage workflow where teams do not rely on scattered indicators or guesswork. They can validate threats, understand the bigger picture, and make faster, more confident decisions. 

Why Triage Is the Heartbeat of the SOC 

Behind every successful SOC, there’s a smooth triage flow that keeps chaos under control. It’s not just about filtering alerts. It’s about shaping the SOC’s rhythm and resilience. 

When analysts perform triage effectively: 

• They build the first and strongest defense layer against real attacks. 
• They ensure human attention is spent where it matters most. 
• They create a foundation for accurate detection and response metrics like MTTD and MTTR. 
• They make security predictable and measurable, not reactive and random. 

Why Triage Quality Matters to SOC Leaders 

For analysts, poor triage means more manual checks, more uncertainty, and more alerts waiting in the queue. For SOC managers, Heads of SOC, CISOs, and MSSP leaders, the impact is bigger. 

Slow or inconsistent triage creates higher escalation pressure, longer response times, missed SLA targets, and less visibility into which threats require urgent action. It also makes it harder to measure SOC performance because every investigation depends too much on individual experience and manual interpretation. 

That is why mature SOCs need more than raw alerts or isolated indicators. They need a repeatable process that helps Tier 1 teams validate threats faster, gives Tier 2 and IR teams cleaner context, and gives leadership a clearer view of incident severity, business risk, and response priorities. 

The Daily Puzzle: Making Sense of a Thousand Pings 

The challenge is not a lack of data — it’s too much of it. The toughest barriers to effective triage include: 

• Alert overload: When every ping demands attention, focus becomes the first casualty. 
• False positives: Automation can cry wolf more often than it should. 
• Threat complexity: Today’s attackers employ sophisticated techniques designed to evade detection. 
• Context gaps: An IP is just an IP until you know its story. 
• Time compression: Analysts often have seconds, not minutes, to make judgment calls. 
• Data silos: TI feeds, SIEMs, and sandboxes don’t always talk to each other. 

The result? Valuable threats risk getting buried under a pile of meaningless noise.

Speed, Precision, and the Numbers That Matter 

In triage, speed without accuracy is chaos, and accuracy without speed is luxury. That’s why SOCs track their efficiency through key metrics. KPIs aren’t just for bosses—they’re your triage compass. Track these to benchmark progress and spot bottlenecks: 

 
High-performing SOCs balance speed and certainty by using intelligence enrichment to cut decision time without cutting quality. Those KPIs are not just numbers; they’re the story of how well your triage works. 

From Metrics to Meaning: Why Triage Drives Business Outcomes 

Triage KPIs are not just operational numbers. They show how well the SOC turns alerts into decisions, decisions into action, and action into measurable risk reduction. 

When MTTD goes down, teams identify suspicious activity earlier. When MTTR improves, incidents move toward containment faster. When false positives and unnecessary escalations decrease, analysts have more time for threats that actually matter. 

For SOCs and MSSPs, stronger triage creates value in several ways: 

• Fewer false positives protect analyst focus and reduce wasted investigation time. 
• Faster validation helps teams meet response expectations and maintain client trust. 
• Better prioritization keeps high-risk incidents from being delayed by low-value alerts. 
• Lower escalation volume gives senior specialists more time for complex investigations. 
• Cleaner triage data makes SOC performance easier to track and improve over time. 

In short, triage is where daily alert handling becomes visible business value. A faster, more structured process helps teams reduce operational waste, improve response quality, and prove that security work is moving risk in the right direction. 

From Alert to Decision: How ANY.RUN Strengthens the Triage Process 

Effective triage is not a single action. It is a sequence of decisions: Is this alert worth attention? What happened? How serious is it? Should the case be closed, escalated, or moved toward response? 

ANY.RUN helps SOC teams move through this process faster by giving analysts one connected workflow for threat validation, context gathering, and evidence collection. 

Step 1: Understand What Triggered the Alert 

Triage usually starts with an indicator: a suspicious IP, domain, file hash, URL, process, or network connection. On its own, that indicator rarely tells the full story. 

With ANY.RUN’s Threat Intelligence, analysts can quickly check whether the IOC has appeared in previous analyses, what malware families or campaigns it may be connected to, and what behavior was observed around it. This gives teams an immediate starting point instead of forcing them to investigate from zero. 

At this stage, the goal is not to make a final verdict yet. The goal is to understand whether the alert has enough risk signals to deserve deeper analysis. 

Step 2: Validate the Threat in a Safe Environment 

If the alert looks suspicious, the next step is behavior validation. At this stage, analysts need to understand what the threat actually does, not just what one IOC or static scan suggests. 

ANY.RUN’s Interactive Sandbox gives teams a safe environment to open suspicious files, URLs, and emails, observe execution in real time, and collect behavioral evidence without risking internal systems. Instead of relying on partial indicators, analysts can see network connections, dropped files, process activity, persistence attempts, phishing flows, redirects, and other signals that confirm whether the alert is real. 

Get Behavior Visibility in Seconds 

In triage, speed matters. ANY.RUN helps analysts reach meaningful evidence quickly, with most malicious behavior becoming visible within the first 60 seconds of analysis. 

View real-world threat analyzed in 60 seconds

This allows Tier 1 teams to validate suspicious activity earlier and avoid spending several minutes manually checking every file, link, or redirect path. 

For SOCs and MSSPs, this means faster verdicts, shorter queues, and less time lost on alerts that do not need deep investigation. 

See What Happens Inside the Browser 

For phishing and web-based threats, the most important evidence often appears inside the browser. Static analysis may show a URL or HTML code, but it can miss what happens after the page loads. 

With in-browser data inspection, analysts get deeper visibility into browser-level activity during URL analysis. They can review redirects, scripts, DOM changes, forms, screenshots, requests, and other page behavior in one place. This helps teams understand how the phishing flow works, what data the page tries to collect, and which artifacts can support detection or response. 

Let Automation Handle Routine Actions 

Many modern threats are built to wait for user behavior. They may require clicks, archive opening, button presses, CAPTCHA solving, QR code extraction, or other actions before the malicious part appears. 

ANY.RUN’s Automated Interactivity helps reveal these threats by mimicking real user actions inside the sandbox. It can click, type, open files, follow links, extract URLs, and solve CAPTCHA challenges, helping the analysis reach the final payload or phishing page faster. 

This saves time for analysts because they do not need to manually repeat every routine step. It also reduces the chance that an evasive threat stays hidden simply because no one interacted with it. 

Keep Analysts in Control When Needed 

Automation speeds up the routine work, but triage still needs human judgment. ANY.RUN remains fully interactive, so analysts can step in at any moment, click through the sample, change the path of execution, test suspicious behavior, or inspect details more closely. 

That combination of automation and manual control is what makes the sandbox valuable for real SOC workflows. Teams can move quickly when the case is simple, but still dig deeper when the alert looks complex, evasive, or business-critical. 

This makes triage more accurate and less dependent on guesswork. Analysts can observe the threat, confirm behavior, collect evidence, and understand what the alert actually means before closing, escalating, or moving it toward response. 

Keep Triage Work Visible Across the Team 

In larger SOCs and MSSPs, triage is rarely handled by one person from start to finish. ANY.RUN’s Teamwork capabilities help managers keep sandbox activity organized by reviewing shared task history, monitoring analyst activity, supervising active analyses, and controlling task privacy settings. 

This gives teams better visibility into ongoing investigations, reduces duplicated work, and helps keep triage consistent across analysts, shifts, and client cases. 

Step 3: Connect Behavior to Threat Context 

Once analysts validate suspicious behavior in the sandbox, the next question is context. Is this an isolated event, or part of a larger malware campaign, phishing operation, or active infrastructure? 

This is where threat intelligence becomes part of the triage decision. Instead of treating an IP, domain, hash, or URL as a separate data point, analysts need to understand how it behaves in real attacks, what infrastructure it connects to, which techniques are involved, and whether similar activity has already been observed in the wild. 

ANY.RUN helps teams connect sandbox findings with live threat intelligence built from millions of real-world malware and phishing investigations. Analysts can move from “what is this indicator?” to “how does this threat operate?” within seconds. 

Link IOCs to Real Behavior 

A single IOC rarely tells the full story. A suspicious domain may be connected to a payload, a C2 server, a phishing kit, or a known malware family. 
 
domainName:”23.ip.gl.ply.gg” 

With ANY.RUN, analysts can enrich indicators with execution context, infrastructure relationships, related analyses, and associated TTPs. This helps Tier 1 teams understand not only whether an IOC is suspicious, but why it matters in the current investigation. 

Understand Whether the Threat Is Active 

Triage decisions become stronger when teams know whether the threat is current. An indicator connected to recent malware activity or active phishing infrastructure should be prioritized differently from an old or isolated artifact. 

ANY.RUN’s Threat Intelligence is based on live attack data from daily investigations across 15,000+ organizations and 600,000 analysts. This gives SOC teams fresh context on active threats and helps them prioritize alerts based on real-world activity, not just static severity. 

Expand the Investigation Without Starting from Zero 

After the first suspicious finding, analysts often need to uncover related infrastructure, additional IOCs, connected samples, or similar behavior patterns. 

ANY.RUN helps teams pivot from one finding to related files, URLs, domains, IPs, malware families, and attack techniques. This turns triage into a more complete investigation and gives teams more useful evidence for detection, hunting, and response. 

Feed Better Context into SOC Workflows 

Threat context should not stay inside one investigation. It should support the rest of the SOC workflow. 

ANY.RUN’s TI Feeds can support triage, incident response, threat hunting, detection engineering, and SIEM/SOAR enrichment. Teams can use the context to reduce manual enrichment, improve alert quality, create better detection logic, and pass clearer information to the next stage of response. 

Step 4: Turn Findings into a Clear Triage Decision 

After behavior validation and threat context enrichment, analysts need to make the final triage call: close the alert, continue monitoring, escalate the case, or move it toward response. 

At this stage, speed still matters, but clarity matters even more. A triage decision should explain what was observed, why it matters, how serious the threat is, and what the next team should do with the case. 

ANY.RUN helps turn investigation results into clear, structured evidence. Instead of manually collecting screenshots, copying IOCs, and rewriting behavior notes, analysts can use Tier 1 Reports to summarize the key findings from the sandbox analysis. 

Give Tier 1 Analysts a Clearer Decision Path 

Tier 1 Reports help analysts quickly understand the verdict, malicious activity, IOCs, behavioral indicators, MITRE ATT&CK techniques, and recommended next steps. 

This supports faster and more confident decisions during early triage. Analysts can see whether the alert should be closed as benign, escalated for deeper investigation, or treated as a confirmed threat that needs response. 

Make Escalation Cleaner 

When escalation is needed, the next team should not receive a vague alert with limited context. They need evidence. 

With structured reporting, Tier 1 teams can pass a clearer case summary to Tier 2, incident response, or detection engineering. The report shows what happened during execution, which indicators were involved, and which behaviors made the case suspicious or malicious. 

This reduces back-and-forth, saves senior specialists time, and helps the investigation move forward faster. 

Help Leaders See the Risk Behind the Alert 

For SOC leaders and MSSP managers, structured triage output also improves visibility. Clear reports make it easier to understand which threats were validated, how severe they were, what actions were taken, and where the team may need more coverage or support. 

This turns triage from a fast technical check into a measurable security process. Teams can track outcomes, improve consistency, and show how daily alert handling contributes to risk reduction. 

In short, this step helps teams move from “we found the evidence” to “we know what decision to make and how to move the case forward.” 

Building a More Consistent Triage Practice 

Expert triage is not only about one strong investigation. It is about making good decisions repeatable across analysts, shifts, and alert types. 

When every analyst follows a different path, triage becomes hard to measure and harder to improve. One person may escalate too early, another may spend too much time on low-risk alerts, and another may miss useful context before closing a case. 

A stronger approach is to standardize how alerts are reviewed, validated, documented, and escalated. 

Define What “Ready for Escalation” Means 

Tier 2 and IR teams should not receive alerts with missing context. Before escalation, analysts should be able to show what triggered the alert, what behavior was confirmed, which indicators were involved, and why the case needs deeper investigation.

This helps reduce back-and-forth and keeps senior specialists focused on cases that truly need their attention. 

Create Clear Rules for Closing Alerts 

Closing an alert should be just as structured as escalating one. Teams need clear criteria for when an alert can be marked as benign, suspicious, or confirmed malicious.

This protects the SOC from two common problems: wasting time on weak signals and closing risky cases too early. 

Make Triage Knowledge Reusable 

Every completed investigation can help the next one. Useful IOCs, behavior patterns, screenshots, ATT&CK techniques, and verdict reasoning should not stay inside one analyst’s notes. 

When findings are documented clearly, they can support future triage, detection engineering, threat hunting, and training for newer team members. 

Review the Process, Not Just the Alert 

Improving triage means looking beyond individual cases. SOC leaders should review where analysts spend the most time, which alert types create unnecessary escalations, where false positives come from, and which steps slow the team down. 

This turns triage into a process that can be measured and improved over time. 

Keep the Workflow Practical 

The best triage process is the one analysts can actually follow during a busy shift. It should reduce manual work, make evidence easier to collect, and help teams move from alert to decision without adding extra complexity. 

That is how triage becomes more than a daily task. It becomes a repeatable SOC capability that improves speed, accuracy, and confidence across the whole team. 

Conclusion: Turn Alert Triage into Measurable SOC Value 

Alert triage is where SOC teams decide what to close, escalate, or move toward response. When that process is slow or inconsistent, teams waste time, senior specialists get overloaded, and real threats can stay unresolved longer. 

ANY.RUN helps SOCs and MSSPs validate threats faster, reduce manual investigation work, improve escalation quality, and give teams clearer evidence for response. 

For security leaders, this means better use of analyst capacity, faster incident handling, stronger SLA performance, and clearer visibility into operational risk. 

With ANY.RUN, triage becomes more than alert handling. It becomes a faster, more consistent process for reducing risk and proving SOC impact. 

About ANY.RUN  

ANY.RUN helps SOC teams, MSSPs, and enterprises investigate cyber threats faster through interactive malware analysis and threat intelligence.

Its cloud-based Interactive Sandbox enables security teams to safely analyze suspicious files, URLs, and emails in real time, observe attack behavior as it unfolds, and collect actionable evidence for rapid response.

ANY.RUN’s Threat Intelligence solutions provide additional context around threats, infrastructure, and attacker activity, helping organizations enrich investigations, streamline security workflows, and improve threat detection. Together, these capabilities enable faster triage, more informed decision-making, and more efficient security operations at scale.

The post Faster Triage, Clearer Evidence, Lower Risk: A SOC Guide to Better Alert Handling appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN changes this forever with in-browser data inspection. 

The new technology takes URL analysis to the next level by bringing static and dynamic analysis into one single workflow. Now, every phishing URL’s behavior like script execution and redirects is visible to the analyst in real time, leaving no blind spots for attackers to exploit.  

Available to all ANY.RUN users, this new layer of URL phishing visibility provides a massive boost for the triage and response speed for SOC & MSSP teams, enabling them to see and contain critical attacks before they become incidents. 

Before vs. After: Fixing Slow and Painful URL Triage Process 

Right now, the typical URL analysis process for most SOC and MSSP teams looks like this: A suspicious URL comes in, and the analyst starts assembling context. They scan the URL to get basic info, sandbox it to see what it does, trace redirects, inspect traffic, and still have to piece everything together manually to make a decision. 

This turns every alert into a time-consuming task. Analysts spend extra time validating signals, escalate cases by default, and still risk closing malicious URLs without fully understanding their behavior.  

URL Analysis with ANY.RUN: Full Static & Dynamic URL Context within Seconds 

In-browser data inspection solves this friction by giving you the full static and dynamic URL context in just one click. The page executes in a real browser, and everything that matters, redirects, scripts, DOM changes, user-facing content, is captured and presented to you in a single view. No tab switching. 

The result is an instant view of the attack in one place: How the user is redirected, what scripts drive the interaction, where data is collected, and how the phishing flow is constructed end-to-end.  

The context that used to take up to an hour to collect is now delivered within seconds, complete with a verdict and ready for confident next-step decisions. 

Why Existing URL Investigation Approaches Fall Short 

Many security solutions still lack the dynamic browser-level visibility needed to clearly understand how a phishing attack unfolds in real time, resulting in critical gaps: 

• Analysts may see a screenshot of the final page, but not the full path that led to it: redirects, scripts, iframe activity, and intermediate page states 

• Limited visibility into the forms, content, and user-facing elements the victim actually saw and interacted with 

• Missing context around DOM changes, injected content, and dynamically loaded elements during page execution 

• Reliance on static page analysis instead of a dynamic, step-by-step view of real browser behavior 

• Lack of automatically collected DOM history that allows analysts to inspect page changes across different execution stages 

• No visibility into browser activity preceding WAF alerts or application logs 

Without browser-level inspection, critical evidence can remain hidden from investigators. As a result, analysts often need to combine multiple tools and data sources to fully understand a single URL. 

The Operational Impact of Visibility Gaps for Security Teams 

These visibility gaps create several operational challenges for SOC teams: 

• Fragmented Workflow: Reconstructing webpage behavior across multiple tools and data sources slows investigations, increases manual effort, and delays response. 

• Inefficient Resource Management: When analysts lack sufficient evidence to classify a URL confidently, potentially benign links are often escalated to senior team members, consuming valuable resources. 

• Phishing Analysis Gap: Solutions focused on file or network activity may miss critical phishing context, leaving analysts without sufficient browser-level evidence. 

As phishing attacks continue to rise, security teams need faster and more reliable ways to investigate suspicious URLs. In-browser data inspection closes this visibility gap by introducing a new layer of webpage-level investigation evidence. 

Beyond URL Scanning: Full Browser Visibility for Phishing Investigations 

As phishing and browser-based threats continue to grow in both volume and sophistication, it’s time for SOC and MSSP teams to upgrade their operations to match the reality of modern attacks. 

Available to all ANY.RUN users, in-browser data inspection introduces an investigation layer missing from many security operations today. Unlike workflows that force analysts to piece together evidence across multiple tools, ANY.RUN provides dynamic, in-depth browser visibility, making URL investigations faster, clearer, and more reliable. 

This new investigation layer enables SOC analysts to: 

• Instantly validate, enrich, and prioritize phishing threats using evidence that often remains hidden in conventional URL analysis workflows 

• Reduce uncertainty during investigations with direct visibility into what happens during execution 

• Reveal the complete attack chain, including redirects, executed scripts, iframes, and dynamically loaded content 

• Track browser and DOM changes across every stage of page execution 

• Gather the evidence required for fast triage, escalation, and response from a single investigation workflow 

• Access threat intelligence required for detection engineering, hunting, and campaign analysis 

All without leaving the sandboxing interface. 

Instead of relying solely on network logs or file traces, the new inspection method allows you to see all browser activity observed on the webpage, including forms, content, DOM changes, scripts, and redirects. This provides direct access to behavioral insights and evidence that often remain unavailable in URL analysis and sandboxing workflows. 

Unlike workflows that require analysts to manually reconstruct browser activity from multiple data sources, in-browser data inspection consolidates browser telemetry, page content, behavioral evidence, and threat intelligence into a single investigation experience. 

This allows teams to move from URL analysis to confident decisions faster, with less effort and greater visibility. The result is accelerated triage, more validated escalations, stronger detections, and more efficient security operations. 

Change the Way You Investigate Phishing with In-Browser Data Inspection 

In-browser data inspection changes how phishing investigations are performed. By delivering dynamic browser visibility within ANY.RUN’s Interactive Sandbox, it helps SOC and MSSP teams investigate threats faster, reduce uncertainty, and make more confident incident response decisions. 

Instead of piecing together screenshots, redirects, page content, browser artifacts, and external intelligence from multiple tools, analysts receive a complete browser-level investigation within a single workflow. 

To start your investigation, simply open the Browser Data tab to access a complete, dynamic view of the web page execution. It’s available within every URL analysis in ANY.RUN’s Interactive Sandbox. 

View analysis 

Understand the Attack Flow 

The Browser Data within ANY.RUN’s Interactive Sandbox provides the entire web page execution tree, from initial URL to the final page view, featuring all redirects and activated iframes. Color highlights and tags point to the pages responsible for triggering detections. 

Investigation outcome: Accelerate triage and escalation decisions by gaining an immediate overview of the dynamic attack flow and identifying the most relevant stages for further analysis. 

Detailed HTTP Requests data provides complete visibility into redirects, requests, and responses generated during page execution.  

Investigation outcome: Improve threat validation and detection engineering by reconstructing redirect chains and collecting evidence for IDS detections and network-based hunting rules. 

Analyze Browser-Level Behavior 

Explore browser-level telemetry, including triggered signatures, domain, URL, and IP statistics, as well as rendered screenshots of the analyzed page. 

Investigation outcome: Improve threat validation and detection engineering by reconstructing redirect chains and collecting evidence for IDS detections and network-based hunting rules. 

To see which code fragments were added to the DOM after the page loaded, go to the HTML DOM Changes tab for deobfuscation. It will reveal what static analysis misses: 

View analysis 

In-browser data inspection captures the fully rendered and interactive state of the page, allowing the analyst to see the actual behavior, including hidden forms, redirects, and user interaction logic that were impossible to understand statically. 

Investigation outcome: Strengthen threat hunting and detection engineering by identifying phishing elements, reconstructing the loading process, and extracting behavioral artifacts. 

Expand the Investigation Beyond the Initial Sample 

Collected Indicators include URLs, domains, IP addresses, and hashes of web content associated with the analyzed page. 

Investigation outcome: Expand investigations beyond a single sample by developing pivoting hypotheses and uncovering attacker-controlled infrastructure. 

Content extracted from web page snapshots can also be used to create custom hunting and detection rules backed by ANY.RUN Threat Intelligence. 

In this example, a YARA rule created from a single phishing page identified 145 related samples within Threat Intelligence Lookup & YARA Search: 

Investigation outcomes: 

• Expand visibility beyond a single URL or alert 

• Validate threat hunting hypotheses with browser-level evidence 

• Assess the scale of an attack campaign 

• Develop resilient detections based on attacker tooling and page artifacts 

Turning Powerful Visibility into Stronger Security Outcomes 

By combining interactive sandboxing, full browser-level visibility, and threat intelligence sourced from over 15,000 security teams, ANY.RUN transforms URL investigations from fragmented, manual analysis into fast, evidence-based decision-making. 

Through eliminating visibility gaps and reducing the need for disconnected tools, security teams can improve outcomes across the entire investigation workflow: 

• Faster triage and fewer unnecessary escalations: With immediate access to browser-level evidence, Tier 1 analysts can validate suspicious URLs faster and escalate fewer benign cases, improving productivity and reducing pressure on senior teams. 

• Smoother handoff and incident response: When escalation is required, Tier 2 analysts receive a complete evidence package rather than disconnected indicators, accelerating validation and reducing MTTR. 

• Stronger detection engineering: Browser telemetry provides a new source of intelligence for building custom detections, hunting hypotheses, and phishing signatures based on real-world attack behavior. 

• Structured reporting: Built-in SOC-ready reports transform complex investigations into decision-ready intelligence, simplifying triage, escalation, response, and stakeholder communication. 

For enterprises and MSSPs, these operational improvements translate into faster investigations, more efficient use of analyst resources, stronger phishing defenses, and the ability to scale security operations without proportionally increasing workload. 

Conclusion 

In-browser data inspection closes a critical visibility gap in modern phishing investigations. With it, SOC analysts and threat hunters can investigate phishing attacks directly inside ANY.RUN without manually extracting web content from traffic captures, reconstructing redirect chains, or comparing raw page source against the content rendered in the browser. 

Instead, all browser-level evidence is collected, correlated, and presented within a single investigation environment, helping enterprise security teams investigate threats faster and respond with greater confidence. 

About ANY.RUN 

ANY.RUN helps SOC teams, MSSPs, and enterprises investigate cyber threats faster through interactive malware analysis and threat intelligence. 

Its cloud-based Interactive Sandbox enables security teams to safely analyze suspicious files, URLs, and emails in real time, observe attack behavior as it unfolds, and collect actionable evidence for rapid response. 

ANY.RUN’s Threat Intelligence solutions provide additional context around threats, infrastructure, and attacker activity, helping organizations enrich investigations, streamline security workflows, and improve threat detection. Together, these capabilities enable faster triage, more informed decision-making, and more efficient security operations at scale. 

FAQ 

The post The New Standard for URL Analysis: Closing Phishing Blind Spots with In-Browser Data Inspection  appeared first on ANY.RUN's Cybersecurity Blog.

Over the past few weeks, the ANY.RUN team joined Infosecurity Europe in London, CONFidence Conference in Kraków, and C1b3rWall Congress in Ávila. While every event had its own focus, the discussions pointed in the same direction: security teams need faster investigations, clearer evidence, and more confidence in every response decision. 

Infosecurity Europe 2026: From Alerts to Business Outcomes 

Infosecurity Europe was the biggest stop of our conference season. Over three days in London, the ANY.RUN team met with CISOs, SOC leaders, and MSSP teams to discuss the challenges shaping security operations today. 

One thing was hard to miss: the conversation has moved beyond alert volumes and technical metrics. 

Security leaders are under growing pressure to show how SOC performance supports the wider business. Boards do not simply want to know how many alerts were reviewed or how quickly a case was closed. They want to understand whether threats are identified early, whether risks are clearly assessed, and whether the team can act before an incident affects operations. 

Three priorities came up repeatedly during our conversations: 

From Alerts to Outcomes 

MTTR still matters, but the number alone does not tell the full story. Security teams need enough context to understand the impact of a threat, prioritize the right cases, and explain their decisions clearly. 

Behavioral analysis plays an important role here. By investigating suspicious files and URLs inside an interactive environment, teams can see how a threat behaves in real time and gather the evidence needed for a more confident response. 

Intelligence Where the Work Happens 

Security teams are not looking for another disconnected platform that adds extra steps to an already complex process. 

They want fresh threat intelligence and investigation-backed insights inside the tools they already use, including SIEM, SOAR, and EDR platforms. This helps teams move from detection to investigation and response without losing time switching between separate systems. 

Resilience Over Headcount 

Growing alert volumes cannot always be solved by growing the team. 

SOC leaders are looking for ways to make existing workflows more effective: reducing manual work, giving teams clearer evidence, and helping junior specialists handle routine investigations with greater confidence.

The goal is not simply to process more alerts. It is to build a more resilient SOC that can make consistent decisions even when the pressure rises. 

Infosecurity Europe was a valuable opportunity to discuss these priorities directly with the cybersecurity community and explore how behavioral visibility and live threat intelligence can support faster, clearer, and more reliable investigations. 

CONFidence Conference 2026: Practical Conversations with the Security Community 

Our next stop was CONFidence Conference in Kraków, where we joined cybersecurity professionals for two days of technical discussions, live demos, and conversations about the realities of modern threat investigation. 

Many of the challenges were familiar: rising alert volumes, increasingly sophisticated phishing campaigns, and the need to investigate threats faster without adding more pressure to already busy teams. 

At the ANY.RUN stand, visitors explored how behavioral visibility, investigation-backed threat intelligence, and cross-platform detection coverage can help SOCs and MSSPs analyze malware and phishing more consistently. 

But choosing the right security solution is not only about detection capabilities. Teams also need to know how they fit into their wider security environment: how sensitive data is handled, whether it supports controlled workflows, and whether the provider has the experience needed to support critical investigations. 

These questions matter even more for organizations operating in regulated industries, where security tools need to support effective threat response while meeting strict internal compliance requirements. 

This is an area ANY.RUN has continued to strengthen throughout its 10 years in cybersecurity. Today, our malware analysis and threat intelligence solutions are used by more than 15,000 organizations worldwide, including 74 of the Fortune 100 companies. ANY.RUN is also SOC 2 Type II attested, reflecting our commitment to strong security controls and careful handling of customer data. 

C1b3rWall Congress 2026: Exploring Ransomware Analysis in Action 

Our final stop was C1b3rWall Congress in Ávila, where cybersecurity professionals from both the public and private sectors gathered at the National Police School to discuss the threats shaping today’s security landscape. 

The event gave us a chance to look more closely at one of the most pressing challenges for security teams: ransomware. 

During our session, we demonstrated how ransomware can be analyzed inside ANY.RUN’s Interactive Sandbox and showed how interactive analysis helps teams move beyond a basic verdict.

Instead of simply confirming that a file is malicious, teams can observe how the attack unfolds in real time, identify suspicious processes, examine network activity, and understand the sequence of actions behind the threat. 

This kind of visibility is especially valuable when every decision matters. It gives security teams the context they need to assess risk faster, document their findings, and respond with greater confidence. 

C1b3rWall was also a valuable opportunity to connect with professionals working across different sectors and discuss how clearer behavioral evidence can support stronger, more reliable investigations.

 What Comes Next 

These events gave us the opportunity to connect with security professionals across Europe, exchange ideas, and discuss the challenges teams are facing today. 

The message was clear: faster investigations matter, but so do visibility, trust, and control. Security teams need solutions that help them act with confidence, even when the pressure is high. 

These conversations will continue to shape how we develop ANY.RUN and support SOCs and MSSPs worldwide. 

Thank you to everyone who stopped by, shared their experience, and joined the discussion. See you at the next events. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate threats faster and make more confident security decisions. 

With its cloud-based Interactive Sandbox, security teams can safely analyze suspicious files, URLs, and emails in real time, observe malicious behavior, and collect clear evidence for response without maintaining complex in-house infrastructure.

ANY.RUN’s Threat Intelligence solutions also help organizations uncover deeper threat context, enrich security workflows, and improve visibility into emerging risks. Together, these capabilities support faster triage, stronger threat response, and more efficient security operations at scale.

The post From Infosecurity Europe to CONFidence and C1b3rWall: What Security Teams Are Prioritizing in 2026 appeared first on ANY.RUN's Cybersecurity Blog.

The challenge is not that analysts lack skill. Most hunting teams are sharp, methodical, and deeply familiar with attacker playbooks. The real friction is structural: the intelligence feeding hunts is often stale, decontextualized, or missing the behavioral granularity needed to write anything more than a broad, noisy detection. 

MITRE ATT&CK tells you a technique exists. It does not tell you how it behaves in a real attack chain against a real target. That gap between abstract TTP and concrete execution behavior is where many hunts quietly die. IOCs arrive stripped of context: you block an IP, a rotated domain from the same campaign lands in your environment three days later, and sails straight through.  

And then there is the false-positive problem. Not a technical inconvenience but a morale and process killer. Every alert that turns out to be Outlook talking to a Microsoft licensing server erodes confidence in the detection pipeline. Over-tuned rules miss real threats; under-tuned rules train analysts to discount the queue. 

In this article, we’ll explore how threat intelligence supports core hunting workflows and how ANY.RUN’s Threat Intelligence solutions help analysts investigate threats with greater speed and confidence. 

Key Takeaways

• Threat hunting fails structurally, not skillfully. The bottleneck is intelligence quality.
• Behavioral context beats indicators. A single IOC blocked solves nothing if the campaign behind it isn’t understood. Pivoting from one artifact — a mutex, a file path, a Suricata tag — into a full attack chain is what separates hunting from blocklisting.
• Hypothesis validation requires real attack data. ATT&CK describes techniques in the abstract. Effective hunting needs to know how a technique behaves in live, active campaigns — which tools operationalize it, what infrastructure it touches, what artifacts it leaves.
• False positives are a strategy problem, not just a noise problem. Every low-fidelity alert that consumes analyst attention is a detection that wasn’t built right. Validating rules against real samples before deployment is the difference between a detection pipeline and a distraction pipeline.
• Intelligence layers serve different operational needs. TI Lookup drives active investigations; TI Feeds keep automated defenses current; TI Reports bridge the gap between raw campaign data and detection engineering or executive briefings.
• AI-assisted triage is a force multiplier, not a replacement. Tier 1 reports, AI summaries, and sandbox recommendations don’t replace analyst judgment — they eliminate the translation work between analysis output and operational action, freeing analysts for work that actually requires them.
• Hunting ROI is measurable — if you instrument it correctly. Earlier detection, defense calibrated to active threats, and analyst time redirected to genuine risk: each is quantifiable. Programs that cannot demonstrate these outcomes don’t lack value — they lack the intelligence infrastructure to produce it consistently.

1. Hypothesis Validation: Device Code Phishing

Scenario: A hunter develops a hypothesis: adversaries may be abusing Microsoft’s Device Code authentication flow to compromise organizational accounts without triggering MFA. The technique is real, but the team needs evidence it is active now and a way to identify the behavioral signatures that distinguish attacks from legitimate device authorization. 
 
The struggle: Generic queries against authentication logs produce enormous volume. Without knowing what a malicious device code flow actually looks like in practice — which referrer domains initiate the redirect, which PhaaS kits are operationalizing the technique, what the email delivery chain looks like — the team is essentially querying blind. 

The solution: TI Lookup allows the hunter to query the Microsoft device auth endpoint directly and immediately retrieve sandboxed sessions where the technique is observed in the wild. 
 
url:”https://login.microsoftonline.com/common/oauth2/deviceauth?code=*” 

Sessions are tagged automatically: Phishing, oauth-ms-phish, and kit-specific tags like Kali365 (a PhaaS platform specializing in Device Code Phishing). 

We can view any of the analyses sessions, for example: https://app.any.run/tasks/fc973b26-7cc8-4253-a313-1b77ff27f04c/  

The hunter can inspect the full referrer chain: 

In live cases, the redirect to Microsoft’s legitimate device auth endpoint originates from external domains, including those with unusual TLDs. 

Subsequent queries can filter by TLD against the device code URL, giving the team a concrete list of suspicious referring domains to feed into SIEM monitoring or block lists. 

url:”https://login.microsoftonline.com/common/oauth2/deviceauth” and domainName:”.de$” 

For more targeted investigation, the hunter can also query by threat name and file path to retrieve the actual phishing emails (.eml files) used to deliver the initial lure, exposing sender patterns, subject line templates, and infrastructure metadata. 

Impact: 

• Hypothesis validated against real, live attack data rather than technique abstractions. 
• Concrete IOCs and behavioral signatures ready for SIEM query development. 
• Email metadata exposed for deeper organizational log correlation. 

2. Behavioral Pivots: Tracking a Stealer Family via Mutex 

Scenario: A suspicious executable is submitted for analysis and identified as a stealer. The analyst notices a mutex with a hardcoded prefix — Global\EVOLUTION — followed by a randomized suffix. The question is whether this prefix is unique to this malware family and, if so, how widely deployed it is. 
 
The struggle: A mutex with a random suffix has no stable IOC value. Standard threat feeds will not carry it. Searching for the full string is guaranteed to miss variants. The behavioral pattern is clearly significant but there is no obvious path from a single sample to campaign-level coverage. 

The solution: A wildcard query in TI Lookup (syncObjectName:”Global\\EVOLUTION*”) immediately surfaces a number of additional samples sharing the same hardcoded prefix with different randomized tails, confirming the pattern is not incidental but a structural artifact of this malware family. 

Cross-referencing the mutex results against file path artifacts reveals that affected systems consistently produce a dump archive at C:\Users\admin\AppData\Local\Temp\evo_[random]\stolen.zip — a second independent behavioral indicator that definitely looks like a stealer.  

Running OR and AND lookup combinations of both indicators allows the hunter to tune coverage: OR for maximum reach, AND for high-confidence, low-noise detections:

• filePath:”C:\Users\admin\AppData\Local\Temp\evo_\stolen.zip” OR syncObjectName:”Global\EVOLUTION”
• filePath:”C:\\Users\\admin\\AppData\\Local\\Temp\\evo_*\\stolen.zip” AND syncObjectName:”Global\\EVOLUTION*” 

Starting from a single mutex observation, the hunter has now built a multi-indicator behavioral profile of an entire malware family. 

Impact:  

• Single behavioral artifact expands into full campaign coverage. 
• Multi-indicator detection logic developed and validated before touching production systems. 
• No reliance on stable IOCs — detection survives malware updates. 

3. Enrichment: Suspicious Domain in an Inbound Email 

Scenario: An email from an unknown sender arrives containing a link to an unfamiliar domain. Standard policy would flag this for review. The analyst needs to determine quickly whether the domain is genuinely malicious or simply unknown, and if malicious, what the full attack chain looks like. 

The struggle: WHOIS data shows the domain is recently registered. Passive DNS shows limited history. Reputation feeds return no verdict. The analyst has a suspicious domain but no behavioral context — no sense of what the domain delivers, what it steals, or what infrastructure it connects to. 

The solution: The domain search in TI Lookup returns sandbox sessions where the domain has been analyzed. 

domainName:”miracleplayssystems.com” 

The hunter opens one and immediately sees a Microsoft 365 login page clone hosted on the suspicious domain, automatically tagged by ANY.RUN.  

Suricata network threat detections reveal the specific phishing kit — FlowerStorm.

The rule details expose the exfiltration endpoint:  

HTTP tab features a separate domain to which stolen credentials are posted:  

The HTTP traffic view makes the data flow explicit: M365 credentials submitted to the fake login page are forwarded to infrastructure the attacker controls, not to any Microsoft domain.  

This gives the analyst not just a verdict but a full attack chain — delivery domain, phishing kit identity, exfiltration endpoint — all from a single lookup. 

Impact:  

• Unknown domain enriched with full attack chain in minutes. 
• Exfiltration infrastructure identified and added to block lists proactively. 
• Phishing kit attribution enables broader campaign hunting. 

4. Expansion: LOLBin Abuse and Campaign Attribution 

Scenario: An alert fires: MSBuild.exe — a standard Microsoft .NET build component — is establishing a network connection to an unknown IP on a non-standard port. This is a textbook living-off-the-land technique, but the specific context (which campaign, which malware family, how widespread) is unknown. 
 
The struggle: MSBuild.exe connecting outbound is not inherently malicious; it is used legitimately in CI/CD pipelines. The challenge is distinguishing targeted abuse from normal build activity and understanding whether the destination IP is part of a broader campaign or an isolated incident. 

The solution: Combining the destination IP with the MSBuild.exe command-line pattern in a TI Lookup query surfaces sessions where the same combination has been observed. 

destinationIP:”212.34.141.103″ and commandLine:”C:\\Windows\\Microsoft.NET\\Framework64\\v*\\MSBuild.exe” 

Opening a representative session shows MSBuild.exe establishing a C2 connection and exfiltrating host reconnaissance data — CPU, OS version, running processes:  

The Processes tab in the sandbox shows what user data gets exfiltrated:

A vendor-specific detection tag (rmrlx) links this activity to a named malware family: 

threatName:”rmrlx” 

Pivoting on that tag reveals associated infrastructure across multiple IP addresses and exposes the threat actor group responsible — Colombian Smugglers — which uses SVG smuggling as a delivery mechanism and has evolved from targeting Colombian organizations to targeting US and European companies. The hunter can now see the full threat actor profile: initial delivery technique (SVG smuggling), malware families used (vjw0rm, quasar, remcos, xworm, rmrlx), geographic targeting, and infrastructure overlap with adjacent groups like BlindEagle. 

threatName:”colombian-smugglers” 

Use this TI Lookup request to find sandbox analyses exposing SVG smuggling technique:  

threatName:”colombian-smugglers” and filePath:”.svg$” 

Impact: 

• Single alert pivots into full threat actor profile and campaign map. 
• Infrastructure correlation surfaces additional C2 endpoints for blocking. 
• Geographic and targeting intelligence enables prioritized defensive response. 

5. False Positive Validation: Hunting Rule Noise Reduction 

Scenario: ANY.RUN’s hunting rules include a signature that fires when a Windows PC hostname is observed being transmitted in network traffic — a behavior common to stealers and RATs that use hostname as a victim identifier.  

suricataMessage:”HUNTING [ANY.RUN] Windows PC hostname observed” 

The rule catches real threats, but the analyst needs to verify that every hit is genuinely malicious before adding it to production detection. 

The struggle: Hunting rules cast wide nets by design. A rule targeting hostname exfiltration will fire on legitimate software that also transmits device identifiers. Without behavioral context, distinguishing malicious exfiltration from legitimate telemetry requires manual investigation of every hit. 

The solution: Let’s view one of the found sandbox analyses: https://app.any.run/tasks/56e01444-87a2-4cf4-874a-41e56ce60221/ 

The analyst sees the Suricata alert firing on Outlook.exe, but the destination is licensing.m365.svc.cloud.microsoft, a legitimate Microsoft licensing endpoint.  

The HTTP details confirm the behavior: Outlook is sending device and license metadata as part of a standard Office perpetual license renewal (renewperpetuallicense), and the server responds with a 200 OK confirming the HomeBusiness2021Retail license status. This is unambiguously legitimate. The analyst documents this as a known false-positive pattern and adds an exclusion for Microsoft licensing endpoints — keeping the rule sharp without discarding it. 

Impact:  

• False positive identified and documented before reaching production. 
• Detection logic refined without reducing coverage of genuine threats. 
• Analyst time focused on confirmed malicious activity. 

6. Detection Engineering: YARA Rule Development and Validation 

Scenario: During stealer sample collection, an analyst encounters a .NET executable that drops a zip archive named with a consistent pattern: Unix-[HOSTNAME]-[ID].zip. The behavioral artifact is interesting but the analyst wants to build a durable, validated detection rule, not just add a file path indicator that will break when the malware author changes the naming convention. 

The struggle: Writing YARA rules against behavioral artifacts requires understanding what strings are genuinely hardcoded into the binary versus what is generated at runtime. Testing rules against a small sample set risks both false positives from broad string matches and false negatives from a sample set too small to represent the full malware family. 

The solution: Static analysis of the .NET binary in Detect It Easy reveals human-readable strings embedded in the assembly — a common characteristic of .NET malware.  

Filtering for strings containing “Unix” surfaces several hardcoded identifiers specific for this malware:  

• Unix Stealer Log 
• UnixStealer 
• UnixStealerIV!@# 
• UnixStealer2024Key! 

A YARA rule built around these strings uses wide matching for Unicode-encoded strings and fullword to minimize false positives.  

rule UnixStealer { 

    meta: 

        description = "Detects UnixStealer malware" 

        date = "2025-12-18" 

        author = "ANY.RUN:A.Adhikara" 

    strings: 

        $x1 = "Unix Stealer Log" fullword wide 

        $x2 = "UnixStealer" fullword 

        $x3 = "UnixStealerIV!@#" fullword wide 

        $x4 = "UnixStealer2024Key" fullword wide 

    condition: 

        uint16(0) == 0x5A4D and any of ($x*) 

}

Running the rule through TI Lookup’s YARA Search validates it against millions of real malware samples — returning 17 matching samples with no unrelated hits.  

Noticing that the year is hardcoded in one string, the analyst refines it to a regex pattern (/UnixStealer20\d{2}Key/ wide) to ensure the rule covers future builds where the author updates the year.  

Re-validation against the corpus confirms the refined rule catches the same 17 samples and introduces no new noise. 

Impact:  

• YARA rule validated against millions of real samples before deployment. 
• Rule designed to survive malware version updates through regex generalization. 
• Detection shipped with high confidence — no post-deployment tuning required. 

How Threat Intelligence Feeds Support Threat Hunting 

WhileTI  Lookup excels at interactive investigations, Threat Intelligence Feeds help operationalize hunting at scale. 

Threat Intelligence Feeds can be integrated directly into SIEM, EDR, XDR, SOAR, firewalls, and other security platforms, providing continuously updated indicators and threat context. 

For threat hunters, this supports several key workflows: 

• Prioritizing investigations involving known malicious infrastructure. 
• Correlating internal telemetry with active attacker infrastructure. 
• Identifying emerging campaigns before internal detections trigger. 
• Automating enrichment during hunts. 
• Reducing manual IOC collection and maintenance. 

By continuously injecting fresh intelligence into security tooling, feeds allow hunting teams to focus on analysis rather than data gathering. 

Accelerating Hunts with Sandbox Intelligence 

ANY.RUN’s Interactive Sandbox provides additional capabilities that reduce investigation time and improve analyst productivity. 

Tier 1 Reports 

Tier 1 Reports automatically summarize malware behavior in analyst-friendly language, making it easier for junior and mid-level analysts to understand threats without spending significant time reviewing every artifact manually. 

This helps SOC teams rapidly assess suspicious files and decide whether deeper hunting activities are necessary. 

AI Summary 

AI Summary condenses complex malware executions into concise narratives, highlighting the most important findings, suspicious behaviors, and attack stages. Hunters can quickly understand what happened during execution before diving into technical details. 

AI Recommendations 

AI Recommendations suggest potential next steps for investigation, including relevant artifacts, indicators, and behaviors worth examining further. This helps analysts identify additional hunting opportunities and reduces the likelihood of missing important evidence. 

Why Threat Hunting Matters to the Business 

Threat hunting is often discussed as a purely technical discipline, but its ultimate purpose is business protection. Organizations invest in hunting because reactive security alone is no longer sufficient. Modern attackers frequently evade automated detections, abuse legitimate tools, and remain hidden for extended periods. 

However, threat hunting itself introduces operational challenges: 

• Significant analyst time requirements. 
• Skill shortages. 
• Investigation fatigue. 
• High volumes of telemetry. 
• Difficulty prioritizing hunting activities. 
• Challenges demonstrating measurable business value. 

Without proper intelligence support, threat hunting can become expensive and inefficient. Threat intelligence helps address these challenges by reducing investigation time, improving prioritization, increasing analyst productivity, and enabling teams to focus on the threats that matter most to the business. 

The result is faster threat discovery, reduced dwell time, lower incident response costs, and improved resilience against advanced attacks. 

For MSSPs, intelligence-driven hunting also enables more scalable operations, allowing analysts to investigate more environments without proportionally increasing staffing requirements. 

Conclusion 

Threat hunting is no longer about manually searching through massive volumes of logs and hoping to uncover something suspicious. 

Successful hunting depends on context. 

Threat intelligence provides that context by connecting indicators, behaviors, infrastructure, malware families, campaigns, and threat actors into a coherent picture. It transforms hunting from a reactive research exercise into a focused, intelligence-driven process. 

With Threat Intelligence Lookup, Threat Intelligence Feeds, Threat Intelligence Reports, YARA Search, and AI-assisted analysis capabilities, SOC teams can validate hypotheses, enrich investigations, expand discoveries, improve detections, and reduce time spent on manual research. 

The result is a threat hunting program that is faster, more scalable, and more closely aligned with both security and business objectives. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate threats faster and make more confident security decisions. 

With its cloud-based Interactive Sandbox, security teams can safely analyze suspicious files, links, and emails in real time, observe malicious behavior, and receive clear evidence for response without maintaining complex in-house infrastructure. 

ANY.RUN’s Threat Intelligence solutions also help organizations uncover threat context, enrich security workflows, and improve visibility into emerging risks. Together, these capabilities support faster triage, stronger incident prevention, and more efficient security operations at scale. 

ANY.RUN is SOC 2 Type II attested and committed to strong security control and customer data protection.

Scale your SOC with faster threat validation →

FAQ

The post Intelligence-Driven Threat Hunting: How SOCs Find What Alerts Miss appeared first on ANY.RUN's Cybersecurity Blog.