Skip to content

Instantly share code, notes, and snippets.

@jdmills-edu

jdmills-edu/ATP-ConvertSafelinkToUrl.ps1

Created January 25, 2018 20:35
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jdmills-edu/a242887f16bf2f1e8354d64f2b39037a to your computer and use it in GitHub Desktop.
Save jdmills-edu/a242887f16bf2f1e8354d64f2b39037a to your computer and use it in GitHub Desktop.
Download ZIP
Microsoft doesn't offer a commandlet that converts an Advanced Threat Protection (ATP) SafeLink into the real target URL. This short script uses the .NET UrlDecode function and RegEx to extract it.
Raw
ATP-ConvertSafelinkToUrl.ps1
<#
.SYNOPSIS
Converts a URL-encoded ATP Safelink to a real URL.
.DESCRIPTION
Microsoft doesn't offer a commandlet that converts an Advanced Threat Protection (ATP) SafeLink into the real target URL. This short script uses the .NET UrlDecode function and RegEx to extract it.
.PARAMETER safelink
A safelinks.protection.outlook.com link that includes the encoded target URL.
.EXAMPLE
ATP-ConvertSafelinkToUrl.ps1 -safelink https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoursite.com&data=email%40domain.com&sdata=xxxx&reserved=0
Returns: https://yoursite.com.
#>
param(
[Parameter(Mandatory=$true)][String]$safelink
)
[Reflection.Assembly]::LoadWithPartialName("System.Web") | Out-Null
$decoded = [System.Web.HttpUtility]::UrlDecode($safelink)
$decoded -match "url=(\S+)&data=\S+"
$url = $Matches[1]
return $url
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment