[{"data":1,"prerenderedAt":1939},["ShallowReactive",2],{"sc:header-data-ja":3,"sc:footer-data-ja":489,"post-ja--posts-2025-12-31-vulnerability-consentfix-c8cd491384b08":519,"authors_data":1352,"content-ja-list-7b291c2dd91a4":1704,"authors_data:Christopher Brumm|Fabian Bader|Thomas Naunheim":1934},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"ja":13},{"title":14,"url":15,"alt":16},"ホーム","/ja","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"ja":21},{"title":22,"description":23},"Workplace","Microsoft 365を基盤に、スマートで安全な、柔軟性の高いワークプレイスを実現します。最新のテクノロジーとアイデンティティサービスが一つにつながります。",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"ja":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"ja":34},{"title":35,"url":36},"Managed Intune","/ja/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"ja":40},{"title":41,"url":42},"Managed Entra","/ja/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"ja":46},{"title":47,"url":48},"Managed Workplace","/ja/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"ja":52},{"title":53,"url":54},"Consulting Services","/ja/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"ja":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"ja":64},{"title":65,"url":66},"Microsoft Entra Suite","/ja/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"ja":70},{"title":71,"url":72},"Microsoft Intune","/ja/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"ja":76},{"title":77,"url":78},"Microsoft Windows","/ja/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"ja":82},{"title":83,"url":84},"Windows 365 Cloud PC","/ja/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"ja":88},{"title":89,"url":90},"Cloud Workplace Foundation","/ja/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"ja":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"ja":100},{"title":101,"url":102},"Microsoft 365 Copilot","/ja/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"ja":106},{"title":107,"url":108},"Teams","/ja/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"ja":112},{"title":113,"url":114},"SharePoint & Power Platform","/ja/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"ja":118},{"title":119,"url":120},"Exchange Online","/ja/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"ja":124},{"title":125,"url":126},"Information Protection & Compliance","/ja/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"ja":130},{"title":131,"description":132},"Azure","Azureで成長を後押しします。IaaSとPaaSによって、クラウドのコストを下げ、効率を高め、イノベーションを進めます。",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"ja":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"ja":142},{"title":143,"url":144},"Azure Managed Services","/ja/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"ja":148},{"title":149,"url":150},"Azure Consulting","/ja/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"ja":154},{"title":155},"シナリオ",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"ja":160},{"title":161,"url":162},"クラウドを計画する","/ja/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"ja":166},{"title":167,"url":168},"クラウドへ移行する","/ja/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"ja":172},{"title":173,"url":174},"ビジネスを刷新する","/ja/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"ja":178},{"title":179,"url":180},"VMware戦略を立て直す","/ja/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"ja":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"ja":190},{"title":191,"url":192},"Azure Foundation","/ja/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"ja":196},{"title":197,"url":198},"Azure AI Foundation","/ja/azure/azure-ai-foundation",{"name":86,"languages":200},{"ja":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"ja":205},{"title":206,"url":207},"Azure Data Foundation","/ja/azure/azure-data-foundation",{"name":188,"languages":209},{"ja":210},{"title":211,"url":212},"Azure Container Foundation","/ja/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"ja":216},{"title":217,"url":218},"Managed Dark Tenant","/ja/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"ja":222},{"title":223,"url":224},"Cloud Adoption Framework","/ja/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"ja":228},{"title":229,"url":230},"Cloud Competence Center","/ja/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"ja":234},{"title":235,"description":236,"emergency":237},"Security","受賞歴のある24時間365日のManaged Service、インシデント対応、最新水準の保護で、クラウドの安全を見守り、インフラを守ります。",{"text":238,"href":239,"skin":240,"icon":241},"サイバー攻撃の渦中ですか？","/ja/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"ja":249},{"title":250,"url":251},"Managed Red Tenant","/ja/security/managed-red-tenant",{"name":214,"languages":253},{"ja":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"ja":259},{"title":260,"url":261},"Sentinel Data Lake","/ja/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"ja":265},{"title":266,"url":267},"Security Consulting","/ja/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"ja":274},{"title":275,"url":276},"Cloud Security Operations Center","/ja/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"ja":280},{"title":281,"url":282},"Global Secure Access","/ja/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"ja":286},{"title":287,"url":288},"MyWorkID","/ja/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"ja":295},{"title":296,"url":297},"Preventive Services","/ja/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"ja":301},{"title":302,"url":303},"Data Security Service","/ja/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"ja":307},{"title":308,"url":309},"Security Copilot Agents","/ja/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"ja":313},{"title":314,"url":315},"NIS2を技術で実装する","/ja/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"ja":319},{"title":320,"description":321},"製品","完全に安全で100%クラウドネイティブなMicrosoft環境のためのCompanion製品です。協働、ネットワーク認証、ソフトウェア管理を強化します。",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"ja":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","クラウドベースのソフトウェア配布",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"ja":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","クラウドからの証明書配布",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"ja":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Office 365のデータをローカルで利用",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"ja":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","サーバー間のデータ移行",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"ja":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Microsoft 365向けのTerraform Provider",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"ja":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","ネットワークの認証",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"ja":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Microsoft Teamsで連絡先を探す",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"ja":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilotのリアルタイム監視",{"name":396,"languages":397},"casestudies",{"ja":398},{"title":399,"url":400,"description":401},"導入事例","/ja/casestudies","当社はクラウドの先駆者として、包括的なクラウドソリューションを提供するMicrosoftのトップパートナーです。ブループリントに基づくアプローチとInfrastructure as Codeの知見が土台にあります。",{"name":403,"languages":404,"children":407},"company",{"ja":405},{"title":406,"description":401},"会社",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"ja":411},{"title":412},"会社概要",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"ja":417},{"title":418,"url":419},"Facts & Figures","/ja/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"ja":423},{"title":424,"url":425},"お問い合わせと拠点","/ja/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"ja":429},{"title":430,"url":431},"スイスのglueckkanja","/ja/company/switzerland",{"name":433,"languages":434},"austria",{"ja":435},{"title":436,"url":437},"オーストリアのglueckkanja","/ja/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"ja":441},{"title":442},"キャリア",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"ja":447},{"title":448,"url":449},"採用情報","/ja/career",{"name":451,"languages":452},"company-young-professionals",{"ja":453},{"title":454,"url":455},"Young Professionals","/ja/young-professionals",{"name":457,"languages":458},"company-jobs",{"ja":459},{"title":460,"url":461},"募集職種","/ja/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"ja":465},{"title":466},"最新情報",[468,474],{"name":469,"languages":470},"company-blog",{"ja":471},{"title":472,"url":473},"ブログ","/ja/blog",{"name":469,"languages":475},{"ja":476},{"title":477,"url":478},"イベント","/ja/events",[480],{"name":481,"languages":482},"career-meta",{"ja":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"ja":487},{"title":488,"url":425,"active":484},"お問い合わせ",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksJa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"プライバシーポリシー","/ja/privacy",{"title":514,"url":515},"運営者情報","/ja/imprint",{"title":517,"url":518},"Cookieなし","/ja/cookies",{"id":520,"title":521,"author":522,"body":526,"cta":494,"description":532,"eventid":494,"extension":1318,"hideInRecent":484,"layout":1319,"meta":1320,"moment":1324,"navigation":325,"path":1345,"seo":1346,"stem":1347,"tags":1348,"webcast":484,"__hash__":1351},"content_ja/posts/2025-12-31-vulnerability-consentfix.md","AuthCodeFix aka ConsentFix",[523,524,525],"Fabian Bader","Christopher Brumm","Thomas Naunheim",{"type":527,"value":528,"toc":1295},"minimal",[529,533,536,539,546,549,552,563,568,576,601,604,610,613,616,622,628,632,643,649,652,655,659,662,668,675,678,698,708,711,714,717,720,723,726,729,732,749,758,761,764,785,789,794,805,809,817,821,835,839,850,854,857,865,868,876,879,887,890,893,914,917,981,984,987,990,993,996,1002,1005,1046,1049,1064,1068,1071,1085,1088,1091,1096,1099,1110,1113,1120,1124,1130,1135,1149,1155,1161,1167,1178,1181,1187,1190,1215,1224,1227,1247,1253,1256,1262,1265],[530,531,532],"p",{},"年末が近づくと恒例のように、新しい脆弱性か巧妙な攻撃手口が現れ、守る側はユーザーを守ろうと奔走することになります。その傍らで、他の攻撃者やレッドチームはそれをよく見て取り入れていきます。",[530,534,535],{},"今年はPushSecurityが「ConsentFix」と名付けた攻撃を見つけました。ClickFix攻撃の発展形で、Entraという王国の鍵をそのまま攻撃者に渡すことになるURIを、ユーザー自身に提供させるものです。実際に観測された手口は、ユーザーが手でコピー＆ペーストすることを前提にしていました。その数日後、John Hammondがコピー＆ペーストを不要にした改良版を実演する動画を公開しました。こちらではユーザーが認可コードを攻撃者にドラッグ＆ドロップするだけで済みます。",[530,537,538],{},"この攻撃がなぜ成立し、デバイスのコンプライアンスをはじめとする条件付きアクセスの要件を一見すり抜けてしまうのか。その技術的な詳細をたどると、OAuth 2.0の認可コードフローに行き着きます。",[530,540,541],{},[542,543],"img",{"alt":544,"src":545},"OAuth 2.0の認可コードフロー","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-01.png",[530,547,548],{},"攻撃者は「Microsoft Azure CLI」クライアントと「Azure Resource Manager」リソースを対象にしたMicrosoft Entraのログインurlを作り、ユーザーが悪意あるサイトを訪れたときにそれを開きます。",[530,550,551],{},"認可コードフローに当てはめると、これはAzure CLIのようなネイティブのパブリックアプリがユーザーを認証するために通常最初に呼び出す手順にあたります。アプリケーションは実行中のマシン上で、ランダムな高位ポートにリスナーを立てます。このポートがいわゆるリプライURIとして使われます。",[530,553,554,555,562],{},"これは自分でも簡単に再現できます。たとえば",[556,557,561],"a",{"href":558,"rel":559},"https://github.com/f-bader/TokenTacticsV2",[560],"nofollow","TokenTacticsV2","を使うか、URIを手で組み立ててください。",[530,564,565],{},[542,566],{"alt":561,"src":567},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-02.png",[530,569,570,571,575],{},"ユーザーがEntra IDへのサインインに成功すると、リプライURI（たとえば ",[556,572,573],{"href":573,"rel":574},"http://localhost:3001",[560]," ）へリダイレクトされます。通常であれば、ここでAzure CLIがこのURIへの呼び出しを受け取り、リダイレクトに含まれる重要かつ決定的な情報を手にします。",[577,578,579,593],"ul",{},[580,581,582,586,589,590,592],"li",{},[583,584,585],"strong",{},"code",[587,588],"br",{},"\nこれがauthorization_codeです。アプリケーションはこれを使ってベアラートークンを要求します。ベアラートークンはアクセストークン、IDトークン、場合によってはリフレッシュトークンから成ります。",[587,591],{},"\nドキュメントによれば、このコードの有効期間はおよそ10分で、その間に引き換える必要があります。",[580,594,595,598,600],{},[583,596,597],{},"state",[587,599],{},"\nこれは省略可能なパラメーターで、アプリケーションは要求と応答で同じ値かどうかを検証すべきです。",[530,602,603],{},"攻撃の筋書きでもユーザーはリダイレクトされますが、localhostで動いているアプリケーションがないため、ブラウザーはエラーになります。",[530,605,606],{},[542,607],{"alt":608,"src":609},"ブラウザーがエラーになる様子","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-03.png",[530,611,612],{},"それでもURIには機微な情報が残っており、攻撃者はユーザーにこれを渡させようとします。ユーザーが応じてしまうと、攻撃者はトークンを引き換え、アクセストークンとリフレッシュトークンを使って対象のリソース、この場合はAzure Resource Managerにアクセスできます。",[530,614,615],{},"次のスクリーンショットでは、ユーザーから渡されたURIを使ってベアラートークンを取得する様子が分かります。",[530,617,618],{},[542,619],{"alt":620,"src":621},"ユーザーから渡されたURIを使ったベアラートークンの取得","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-04.png",[623,624,625],"blockquote",{},[530,626,627],{},"検知の仕組みを試す場合は、最後の手順を別のネットワークにある別のシステムから実行してください。",[629,630,631],"h2",{"id":631},"検知に使えるアーティファクト",[530,633,634,635,638,639,642],{},"攻撃を再現して",[585,636,637],{},"SigninLogs","と",[585,640,641],{},"AADNonInteractiveUserSignInLogs","を確認すると、この1回のサインイン活動に対して2つのイベントが見つかります。1つ目は実際のユーザーのサインインを表し、2つ目は攻撃者側の基盤から発生したものです。",[530,644,645],{},[542,646],{"alt":647,"src":648},"アクティビティログ","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-05.png",[530,650,651],{},"大きな違いは、1つ目が対話的なサインインイベントであるのに対し、2つ目が非対話的である点です。これは認証フローの2つの段階に対応します。まずユーザー、次にアプリケーション、この場合は攻撃者です。",[530,653,654],{},"Azure CLIの通常の挙動であれば、2つのサインインイベントは同じIPアドレスから発生します。しかしこの例ではIPアドレスが異なり、しかも別の国から来ています。もちろん後者は当てにできる指標ではありません。攻撃者が足跡を隠すために被害者と同じ国に居ることもありうるからです。",[656,657,658],"h3",{"id":658},"欠けているつながり",[530,660,661],{},"この2つのイベントを結びつける良い手がかりを探したとき、まず思いつくのはUnique Token Identifier（UTI）を見ることです。ところがMicrosoftは認可コードのUTIとベアラートークンのUTIに別の値を使うため、この方法は確かなつながりにはなりません。",[530,663,664],{},[542,665],{"alt":666,"src":667},"Unique Token Identifier","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-06.png",[530,669,670,671,674],{},"一方で",[585,672,673],{},"SessionId","は2つを結ぶ良い手がかりになります。ただし長く使われ続けるIDなので、正当なものを含めてこの組み合わせが複数含まれることもあります。",[530,676,677],{},"認可コードフローの制約という知識に加えて、ユーザーIDとアプリケーションIDも手がかりに使えば、時間が重要な検知の材料になります。",[577,679,680,683,686,689,692,695],{},[580,681,682],{},"両方のイベントのSessionIdが同じであること",[580,684,685],{},"両方のイベントのApplicationIdが同じであること",[580,687,688],{},"両方のイベントのUserIdが同じであること",[580,690,691],{},"2つ目のイベントが1つ目より後であること",[580,693,694],{},"2つ目のイベントが1つ目からおよそ10分以内に収まっていること。ちょうど10分にすべきではありません。Microsoftは「[...] they expire after about 10 minutes」と書いているからです",[580,696,697],{},"対象にするのは直後の2つ目のイベントだけで、それ以降のものは含めないこと",[623,699,700],{},[530,701,702,705,707],{},[583,703,704],{},"豆知識",[587,706],{},"\nResourceIdentityは良い手がかりではありません。リソースは認可コードに紐づいていないため攻撃者が変更できるからです。対象のアプリケーションIDは変更できません。",[629,709,710],{"id":710},"ノイズを減らす",[530,712,713],{},"ここまでの知識ですでに十分に使える検知ができましたが、それでも良性の検出が混ざっていました。最近の開発者は、ローカルのインスタンスのように見えるクラウドのリソースを使うため、ログには不規則なログインの並びが残ります。",[530,715,716],{},"決め手になるのは時間の要素です。この攻撃はURIをコピー＆ペーストするかドラッグ＆ドロップするというユーザーの操作を必要とするのに対し、良性の検出の発生源として特定したGitHub Codespaceの使い方は完全に自動化されていて、認可コードを数秒のうちに引き換えます。",[530,718,719],{},"そのため、この認証のやり取りを数秒で済ませているものを除外すれば、ほぼ良性として取り除けます。",[530,721,722],{},"もう1つのノイズの原因になりうるのが、インターネット通信の出口が変わることです。とくにSD-WAN、ZTNA、Secure Web Gatewayを使う構成で起こります。",[629,724,725],{"id":725},"影響を受けるファーストパーティアプリケーション",[530,727,728],{},"最初の報告では悪用されたアプリケーションとして「Microsoft Azure CLI」が挙げられていますが、どのテナントにも事前同意済みで存在し、localhostをリダイレクト先として認めるMicrosoftのファーストパーティアプリは他にもたくさんあります。しかも対象はそれだけではありません。攻撃者は、公開名前解決できないテスト用や開発用のリプライURLも悪用できます。",[530,730,731],{},"リソースに対する事前同意の権限が強い、とくに注意すべきアプリケーションを挙げます。",[577,733,734,737,740,743,746],{},[580,735,736],{},"Microsoft Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46)",[580,738,739],{},"Microsoft Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2)",[580,741,742],{},"Visual Studio (04f0c124-f2bc-4f59-8241-bf6df9866bbd)",[580,744,745],{},"Visual Studio Code (aebc6443-996d-45c2-90f0-388ff96faa56)",[580,747,748],{},"MS Teams PowerShell Cmdlets (12128f48-ec9e-42f0-b203-ea49fb6af367)",[530,750,751,752,757],{},"こうしたアプリの全一覧は、同僚のFabian Baderによって",[556,753,756],{"href":754,"rel":755},"https://entrascopes.com/?authcodeFix=true",[560],"EntraScopes.com","に収録されています。",[629,759,760],{"id":760},"緩和策と保護",[656,762,763],{"id":763},"攻撃面と対象範囲を絞る",[765,766,769,772,773,775,778,779,781,784],"div",{"className":767},[768],"option-block",[583,770,771],{},"導入の手間："," 低〜高（正当な利用者を洗い出す手間による）",[587,774],{},[583,776,777],{},"緩和の効果："," 中（攻撃の対象になりうる範囲を狭める）",[587,780],{},[583,782,783],{},"適用範囲："," 限定的\n",[656,786,788],{"id":787},"選択肢1ユーザーの割り当てを必須にする","選択肢1：ユーザーの割り当てを必須にする",[790,791,793],"h4",{"id":792},"前提条件","前提条件：",[577,795,796,799,802],{},[580,797,798],{},"対象となるファーストパーティアプリのサービスプリンシパルを、Microsoft Graph APIまたはPowerShellで追加する",[580,800,801],{},"サービスプリンシパルのオブジェクトに対して、Microsoft Graph APIまたはPowerShellでユーザー割り当ての要件を適用する",[580,803,804],{},"Access Packages、PIM-for-Groups（Just-in-Timeアクセス用）、またはその組み合わせによって、申請に応じてユーザーを割り当てる手順を整える。",[806,807,808],"style",{},"\n.code-block {\n  background-color: #f6f8fa;\n  padding: 0 16px 16px 16px;\n  border-radius: 6px;\n  font-family: Menlo, Consolas, Monaco, \"Courier New\", monospace;\n  font-size: 14px;\n  line-height: 1.5;\n  overflow-x: auto;\n  white-space: pre;\n  border: 1px solid #d0d7de;\n}\n",[810,811,814],"pre",{"className":812},[813],"code-block",[585,815,816],{},"\n// Example for Microsoft Graph PowerShell\nConnect-MgGraph -Identity\n$AppId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\" // Microsoft Azure CLI\n$sp = Get-MgServicePrincipal -Filter \"appId eq '$AppId'\"\nUpdate-MgServicePrincipal -ServicePrincipalId $sp.Id -AppRoleAssignmentRequired:$false\n",[790,818,820],{"id":819},"利点","利点：",[577,822,823,826,829,832],{},[580,824,825],{},"Access Packagesや手動のグループ所属を通じてユーザーの割り当てを管理でき、この攻撃手法にさらされる範囲を絞れます。",[580,827,828],{},"対象候補としてのグループ所属と組み合わせてJust-in-Timeアクセスを提供でき、CLIツールへのアクセスを一時的なものにすることで攻撃面をさらに狭められます。",[580,830,831],{},"条件付きアクセスのポリシーを評価する前に適用されます。",[580,833,834],{},"他の筋書きに対しても攻撃面を狭めます。",[790,836,838],{"id":837},"欠点","欠点：",[577,840,841,844,847],{},[580,842,843],{},"対象を絞れるのは特定のユーザーまでで、特定のデバイスの利用といった他の要件とは組み合わせられません",[580,845,846],{},"正当なCLIツールの利用者をすべて洗い出す必要があります",[580,848,849],{},"これまでのサインインを確認しながら、副作用と組織への影響を丁寧に見極める必要があります。",[656,851,853],{"id":852},"選択肢2条件付きアクセスのポリシーでアクセスを遮断する","選択肢2：条件付きアクセスのポリシーでアクセスを遮断する",[790,855,793],{"id":856},"前提条件-1",[577,858,859,862],{},[580,860,861],{},"「Microsoft Graph Command Line Tools」と「Windows Azure Service Management API」を対象に、正当な利用者を除外したうえでCLIツールへのアクセスを遮断する条件付きアクセスのポリシーを作成する",[580,863,864],{},"除外はグループ所属で管理する。手動でも、エンタイトルメント管理（Access Packagesなど）でもよい。",[790,866,820],{"id":867},"利点-1",[577,869,870,873],{},[580,871,872],{},"正当でない利用者や権限のない利用者へのトークン発行を防ぎます。",[580,874,875],{},"デバイスやネットワークといった追加の条件に基づいて、きめ細かく対象を絞れます。",[790,877,838],{"id":878},"欠点-1",[577,880,881,884],{},[580,882,883],{},"正当なCLIツールの利用者をすべて洗い出して除外する必要があります。",[580,885,886],{},"これまでのサインインを確認し、ポリシーをレポート専用モードで評価しながら、副作用と組織への影響を丁寧に見極める必要があります。",[656,888,889],{"id":889},"認可コードフローによるトークン発行を遮断する",[806,891,892],{},"\n.option-block {\n  background-color: #f6f8fa;\n  padding: 16px;\n  margin-bottom:2rem;\n  border-radius: 6px;\n  overflow-x: auto;\n  border: 1px solid #d0d7de;\n}\n",[765,894,896,899,900,902,904,905,907,904,909,911,913],{"className":895},[768],[583,897,898],{},"選択肢："," トークン保護を必須にする",[587,901],{},[583,903,771],{}," 高",[587,906],{},[583,908,777],{},[587,910],{},[583,912,783],{}," 非常に限定的\n",[790,915,793],{"id":916},"前提条件-2",[577,918,919,922,925,944],{},[580,920,921],{},"Microsoft Entra ID P1のライセンス",[580,923,924],{},"Windowsプラットフォーム上のEntra ID登録デバイス、ハイブリッド参加デバイス、またはEntra ID参加デバイス",[580,926,927,932,933,932,938,943],{},[556,928,931],{"href":929,"rel":930},"https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively?view=azure-cli-latest#sign-in-with-web-account-manager-wam-on-windows",[560],"Azure CLI","、",[556,934,937],{"href":935,"rel":936},"https://learn.microsoft.com/en-us/powershell/azure/configure-global-settings?view=azps-15.1.0#web-account-manager-wam",[560],"Azure PowerShell",[556,939,942],{"href":940,"rel":941},"https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/set-mggraphoption?view=graph-powershell-1.0#set-web-account-manager-support",[560],"Microsoft Graph PowerShell","でWeb Account Manager（WAM）を有効にする（最近のバージョンでは既定）",[580,945,946,947],{},"条件付きアクセスを次のように構成する。\n",[577,948,949,963,970],{},[580,950,951,952],{},"クラウドアプリの対象を次のアプリに設定する。\n",[577,953,954,957,960],{},[580,955,956],{},"Office 365 Exchange Online",[580,958,959],{},"Office 365 SharePoint Online",[580,961,962],{},"Microsoft Teams Services",[580,964,965,969],{},[966,967,968],"em",{},"モバイルアプリとデスクトップクライアント"," のクライアントアプリにトークン保護を必須とする。",[580,971,972,973,976,977,980],{},"ポリシーの対象とする ",[966,974,975],{},"デバイスプラットフォーム"," として ",[966,978,979],{},"Windows"," を選ぶ",[790,982,820],{"id":983},"利点-2",[530,985,986],{},"Microsoft Entraのトークン保護はproof-of-possession（PoP）を要求します。これは、クライアントがWindowsのWeb Account Manager（WAM）のような信頼されたトークンブローカーと直接やり取りする場合にしか強制できません。ブラウザーはこの安全な経路を確立できないため、ブラウザーで開始された認可コードフローはトークン保護のポリシーによって遮断されます。",[530,988,989],{},"ポリシーがブローカー経由のPoPを要求するトークン保護を強制している場合、ブラウザーに返された認可コードは引き換えられません。コードをトークンに交換する際に必要となる、ブローカーが署名した証明をブラウザーが作れないからです",[530,991,992],{},"この場合、対象のアプリケーションをトークン保護で守れる限り、AuthCodeFixによる攻撃は完全に緩和されます。",[530,994,995],{},"下のスクリーンショットのとおり、フィッシングによって被害者に開始させた認可コードフローの引き換えを、トークン保護がしっかり止めています。",[530,997,998],{},[542,999],{"alt":1000,"src":1001},"認可コードフローの引き換えをトークン保護が止めている様子","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-07.png",[790,1003,838],{"id":1004},"欠点-2",[577,1006,1007,1037,1040,1043],{},[580,1008,1009,1010],{},"公式にサポートされているリソースは次のものだけです。\n",[577,1011,1012,1014,1016],{},[580,1013,956],{},[580,1015,959],{},[580,1017,962,1018,1020,1022,1023,638,1026,1030,1031,1036],{},[587,1019],{},[587,1021],{},"\nMicrosoft Graph APIは前述のリソースを通じて間接的に含まれ、Microsoft Graph PowerShellはサポート対象のクライアントとして挙げられています。この筋書きでも攻撃が緩和されることは、当社の検証で確認できました。「Windows Azure Service Management API」はサポート対象のリソースとして挙げられていません。2つのCLIクライアント（",[556,1024,931],{"href":929,"rel":1025},[560],[556,1027,937],{"href":1028,"rel":1029},"https://learn.microsoft.com/en-us/powershell/azure/authenticate-interactive?view=azps-15.1.0#benefits-of-wam",[560],"）はどちらもWAMに対応しており、これはトークン保護を使うためのクライアント側の要件です。MicrosoftはAzureの管理シナリオ向けにトークン保護の機能を広げることを",[556,1032,1035],{"href":1033,"rel":1034},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/4062700",[560],"ブログ記事","で表明しています。",[580,1038,1039],{},"Microsoft Graph PowerShellにいくつか不具合があり、WAMの連携を一時的に無効にせざるをえない場合があります",[580,1041,1042],{},"これまでのサインインを確認し、ポリシーをレポート専用モードで評価しながら、副作用と組織への影響を丁寧に見極める必要があります。クラウドアプリを対象にすると、Microsoft 365の日常業務のアクセスにも影響します。",[580,1044,1045],{},"対応するプラットフォームとEntra ID連携デバイスでしか使えないため、適用範囲は限られます。",[656,1047,1048],{"id":1048},"準拠ネットワークの確認または信頼済みネットワークで以降のトークン発行を遮断する",[765,1050,1052,1054,1055,1057,1054,1059,1061,1063],{"className":1051},[768],[583,1053,771],{}," 中",[587,1056],{},[583,1058,777],{},[587,1060],{},[583,1062,783],{}," 広い\n",[656,1065,1067],{"id":1066},"選択肢global-secure-accessで準拠ネットワークの外からのアクセスを遮断する","選択肢：Global Secure Accessで準拠ネットワークの外からのアクセスを遮断する",[790,1069,793],{"id":1070},"前提条件-3",[577,1072,1073,1076,1079,1082],{},[580,1074,1075],{},"Entra ID P1のライセンス",[580,1077,1078],{},"Windows、macOS、Android、iOSの各プラットフォーム上のEntra ID登録デバイス、ハイブリッド参加デバイス、またはEntra ID参加デバイス",[580,1080,1081],{},"対象となるすべてのクライアントにGlobal Secure Accessクライアントを導入し、M365 Traffic Profile向けにEntra Internet Accessを有効にすること",[580,1083,1084],{},"ネットワークの準拠確認を強制する条件付きアクセスのポリシーを、すべてのクラウドアプリに適用すること",[790,1086,820],{"id":1087},"利点-3",[530,1089,1090],{},"信頼済みネットワークの確認を強制することで、以降のトークン発行を遮断します。この緩和策により、攻撃者は認可コードフローで得たリフレッシュトークンを使って新しいトークンを取得できなくなります。ただし、最初の認可コードの引き換えや最初のアクセストークンの発行そのものは防げません。そのトークンはもともと被害者が要求したものなので、準拠ネットワークの外でも有効なままです。",[623,1092,1093],{},[530,1094,1095],{},"準拠ネットワークの条件とともにGSAを強制すると、他のトークンリプレイの筋書きも遮断でき、検知やハンティングにとても役立つログも増えます。",[790,1097,838],{"id":1098},"欠点-3",[577,1100,1101,1104,1107],{},[580,1102,1103],{},"Global Secure Accessクライアントを導入したユーザーとデバイスにしか適用できません",[580,1105,1106],{},"Entra ID連携デバイスでしか使えないため、適用範囲は限られます",[580,1108,1109],{},"条件付きアクセスで準拠ネットワークを強制する際は、鶏と卵の問題を避けるためにIntuneなどいくつかの除外が必要になります。展開前に入念な検証が要ります",[629,1111,1112],{"id":1112},"ハンティングクエリ",[530,1114,1115,1116,1119],{},"トークン窃取の緩和に必要な前提が整ったら、つまりGSAクライアントを展開し（",[585,1117,1118],{},"NetworkAccessTraffic","ログの取り込みを含む）、WAM認証を活かせるようになったら、脅威ハンティングと裏づけの手立てが増えます。",[656,1121,1123],{"id":1122},"gsaのログとwam認証を使ったハンティングまたは検知結果の確度の確認","GSAのログとWAM認証を使ったハンティング、または検知結果の確度の確認",[530,1125,1126,1127,1129],{},"このハンティングクエリは、Global Secure Access（GSA）の",[585,1128,1118],{},"ログを使います。このログには、Microsoft Entraのトークンエンドポイントとの通信を開始したプロセスが含まれます。これにより、トークン要求がブラウザーから直接出たものかどうか、またGSAのネットワークの外で追加のトークン要求が行われたかどうかを判断できます。",[623,1131,1132],{},[530,1133,1134],{},"このクエリは前提条件が満たされている場合にのみ動作し、信頼できる結果を返します。そうでなければ誤検知が多くなります。",[530,1136,1137,1140,1141,1144,1145,1148],{},[583,1138,1139],{},"なぜこれが効くのか","。WindowsデバイスでWeb Account Manager（WAM）を使ってCLIやPowerShellのモジュールからサインインする場合、ブラウザーを介した認可コードは関与しません。このサインインの挙動は最近のバージョンでは既定です。したがって、開始したプロセスがブラウザーの実行ファイル（たとえば",[585,1142,1143],{},"msedge.exe","）であれば、それは疑わしい活動の強い手がかりになります。macOSでは、Platform SSOを使っているとCompany Portalアプリ（",[585,1146,1147],{},"com.microsoft.CompanyPortalMac.ssoextension","）がプロセスを開始します。",[530,1150,1151,1154],{},[583,1152,1153],{},"トークンのバインドとPoP","。WAM認証では通常、Proof-of-Possession（PoP）を強制することでトークンがデバイスに紐づきます。攻撃者はPoPなしにはさらに紐づいたトークンを発行できないため、紐づいていないリフレッシュトークンもまた強い手がかりです。",[530,1156,1157,1160],{},[583,1158,1159],{},"制約","。ここで挙げた手がかりはいずれも、アクセス元のデバイスがMicrosoft Entra IDに登録または参加している場合にしか得られません。",[530,1162,1163,1166],{},[583,1164,1165],{},"確度スコアの考え方","。このクエリは複数の手がかりを組み合わせて確度スコアを算出します。",[577,1168,1169,1172,1175],{},[580,1170,1171],{},"トークン要求を開始したブラウザーのプロセスがあるか。",[580,1173,1174],{},"紐づいていないトークンへの降格を検知したか。",[580,1176,1177],{},"サインインの間にネットワークプロバイダーが変わったか（準拠から非準拠への変化を含む）。",[530,1179,1180],{},"これらの手がかりは、活動を探すためにクエリの中で使うこともできますし、先の検知に基づいてインシデントが起きた際の確度スコアを導くのにも使えます。",[530,1182,1183],{},[542,1184],{"alt":1185,"src":1186},"ハンティングクエリで使う手がかり","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-08.png",[530,1188,1189],{},"条件に応じて、次のようにスコアが表示されます。",[530,1191,1192,1195,1196,1198,1199,1201,1203,1206,1207,1209,1211,1214],{},[583,1193,1194],{},"非常に高い確度","は、",[585,1197,1118],{},"のログがトークン要求の開始元として見慣れたブラウザーのプロセスを示し、かつ紐づいていないトークンへの降格が検知された場合に表示されます。",[587,1200],{},[587,1202],{},[583,1204,1205],{},"高い確度","は、別のネットワークプロバイダー（ASN）からのサインインであり、かつ紐づいていないトークンを伴う非準拠ネットワークだった場合に表示されます。",[587,1208],{},[587,1210],{},[583,1212,1213],{},"中程度の確度","は、ネットワークプロバイダーの変化と準拠ネットワークだけが確認され、あわせて使われたトークンの種類が変わっている場合に表示されます。",[530,1216,1217,1218,1223],{},"ハンティングクエリの最新版は",[556,1219,1222],{"href":1220,"rel":1221},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-Authentication/ConsentFix-HuntingConfidenceOnTokenAndNetworkSignals.kusto",[560],"GitHub","にあります。",[656,1225,1226],{"id":1226},"発行されたトークンによる活動を追う",[530,1228,1229,1230,1233,1234,1239,1240,1242,1243,1246],{},"調査はサインインのイベントだけにとどめず、攻撃者が発行させたトークンを使って行われた活動まで広げて考えるべきです。同僚のThomas Naunheimが",[585,1231,1232],{},"MicrosoftCloudActivity","という",[556,1235,1238],{"href":1236,"rel":1237},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-TokenHunting/MicrosoftCloudActivity.func",[560],"KQL関数を公開しており","、この広げた調査に役立ちます。さらに、対象の",[585,1241,673],{},"を、先のハンティングで見つけた疑わしい",[585,1244,1245],{},"UniqueId","と突き合わせれば、より深く分析できます。",[530,1248,1249],{},[542,1250],{"alt":1251,"src":1252},"KQL関数","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-09.png",[530,1254,1255],{},"この例では、攻撃者は攻撃中に得たリフレッシュトークンを使ってMicrosoft Graph API向けのアクセストークンを発行させました。そのトークンを使って被害者が所有するアプリケーションにクライアントシークレットを追加し、居座りと横展開を図っています。このクエリは、トークン保護の状態や、その操作がGlobal Secure Accessのネットワークの外で行われたかどうかを含め、Graph APIの操作の詳細を示します。",[530,1257,1258],{},[542,1259],{"alt":1260,"src":1261},"Graph APIの操作のスクリーンショット","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-10.png",[629,1263,1264],{"id":1264},"さらに読む",[577,1266,1267,1274,1281,1288],{},[580,1268,1269],{},[556,1270,1273],{"href":1271,"rel":1272},"https://pushsecurity.com/blog/consentfix",[560],"ConsentFix: Analysing a browser-native ClickFix-style attack that hijacks OAuth consent grants - PushSecurity",[580,1275,1276],{},[556,1277,1280],{"href":1278,"rel":1279},"https://youtu.be/AAiiIY-Soak",[560],"Hacking Endpoint to Identity (Microsoft 365): \"ConsentFix\" - YouTube",[580,1282,1283],{},[556,1284,1287],{"href":1285,"rel":1286},"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow",[560],"Microsoft identity platform and OAuth 2.0 authorization code flow",[580,1289,1290],{},[556,1291,1294],{"href":1292,"rel":1293},"https://entrascopes.com/?appId=04b07795-8ddb-461a-bbee-02f9e1bf7b46",[560],"Microsoft Azure CLI on entrascpes.com",{"title":1296,"searchDepth":1297,"depth":1297,"links":1298},"",2,[1299,1303,1304,1305,1313,1317],{"id":631,"depth":1297,"text":631,"children":1300},[1301],{"id":658,"depth":1302,"text":658},3,{"id":710,"depth":1297,"text":710},{"id":725,"depth":1297,"text":725},{"id":760,"depth":1297,"text":760,"children":1306},[1307,1308,1309,1310,1311,1312],{"id":763,"depth":1302,"text":763},{"id":787,"depth":1302,"text":788},{"id":852,"depth":1302,"text":853},{"id":889,"depth":1302,"text":889},{"id":1048,"depth":1302,"text":1048},{"id":1066,"depth":1302,"text":1067},{"id":1112,"depth":1297,"text":1112,"children":1314},[1315,1316],{"id":1122,"depth":1302,"text":1123},{"id":1226,"depth":1302,"text":1226},{"id":1264,"depth":1297,"text":1264},"md","post",{"lang":1321,"seoTitle":1322,"titleClass":1323,"date":1324,"categories":1325,"blogtitlepic":1326,"socialimg":1327,"customExcerpt":1328,"keywords":1329,"scripts":1330,"asideNav":1331,"maxContent":325,"published":325},"ja","ConsentFix：新しいOAuth攻撃がMicrosoft Entraの条件付きアクセスをすり抜ける仕組み","h2-font-size","2025-12-31",[235],"head-consentfix","/blog/heads/head-consentfix.jpg","年の瀬を前にConsentFixが現れました。正規の認証フローを悪用して認可コードを盗み出し、事実上Microsoft Entraの鍵を攻撃者に渡してしまう巧妙なOAuthベースの攻撃です。条件付きアクセスがあってもなぜ通ってしまうのか、ログにどんな痕跡が残るのか、そして守る側が実害の出る前にどう検知し止められるのかを解きほぐします。","ConsentFix攻撃, OAuth認可コードの窃取, Microsoft Entra OAuth攻撃, Azure CLIのトークン悪用, Entra IDの条件付きアクセス回避, 認可コードのフィッシング, Azureのトークンリプレイ攻撃, Proof of Possessionトークン, WAM認証のセキュリティ, Azureサインインログの分析, EntraでのOAuth攻撃の検知, AzureのIDに対する脅威ハンティング, Global Secure Accessのトークン保護, Microsoft Entraのセキュリティ検知",{"slick":325,"form":325},{"menuItems":1332},[1333,1335,1337,1339,1341,1343],{"href":1334,"text":631},"#検知に使えるアーティファクト",{"href":1336,"text":710},"#ノイズを減らす",{"href":1338,"text":725},"#影響を受けるファーストパーティアプリケーション",{"href":1340,"text":760},"#緩和策と保護",{"href":1342,"text":1112},"#ハンティングクエリ",{"href":1344,"text":1264},"#さらに読む","/posts/2025-12-31-vulnerability-consentfix",{"title":521,"description":532},"posts/2025-12-31-vulnerability-consentfix",[1349,1350,281],"OAuth 2.0","Microsoft Entra ID","PNbueD9hk4t4KmFdYJ8BNvZ152w8svOjQBWemi2StAk",{"id":1353,"extension":1354,"meta":1355,"stem":8,"__hash__":1703},"authors_data/authors.json","json",{"path":1356,"Fritz Zurhorst":1357,"Alexander Schlindwein":1363,"Sophie Luna":1369,"Nadine Klein":1377,"Karsten Kleinschmidt":1383,"Julian Wendt":1391,"Holger Bunkradt":1396,"Ralf Mania":1402,"Oliver Kieselbach":1408,"Steffen Schwerdtfeger":1414,"Gunnar Winter":1422,"Jan Petersen":1427,"Thorsten Kunzi":1432,"Moritz Pohl":1436,"Thorben Pöschus":1441,"Christoph Hannebauer":1447,"Marco Scheel":1451,"Christopher Brumm":1456,"Florian Klante":1462,"Niklas Bachmann":1467,"Nils Krautkrämer":1472,"Patrick Treptau":1478,"Peter Beckendorf":1483,"Patrick Sobau":1488,"Jörg Wunderlich":1493,"Michael Breither":1497,"Christian Kanja":1502,"Zeba Hoffmann":1508,"Jochen Fröhlich":1513,"Jan Geisbauer":1517,"Gerrit Reinke":1529,"Christian Kordel":1535,"Stephan Wälde":1539,"Carolin Kanja":1544,"Adrian Ritter":1550,"Marvin Bangert":1555,"Thorsten Pickhan":1561,"Christian Lorenz":1567,"Denis Böhm":1572,"Fabian Bader":1577,"Juan Jose Fernandez Perez":1582,"Mahschid Sayyar":1587,"Benjamin Dassow":1592,"Markus Walschburger":1597,"Jonathan Haist":1602,"Daniel Rohregger":1607,"Thomas Naunheim":1612,"Florian Stöckl":1616,"Pascal Asch":1621,"Markus Kättner":1626,"Anna Ulbricht":1633,"Annette Brauns":1640,"body":1646,"title":1702},"/authors",{"display_name":1358,"avatar":1359,"permalink":1360,"linkedin":1361,"imageOffsetTop":1362},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1364,"avatar":1365,"permalink":1366,"twitter":1367,"linkedin":1368},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1370,"avatar":1371,"permalink":1372,"twitter":1373,"linkedin":1374,"imageOffsetLeft":1375,"imageOffsetTop":1376},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1378,"avatar":1379,"permalink":1380,"twitter":1381,"linkedin":1382,"imageOffsetTop":1362},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1384,"avatar":1385,"permalink":1386,"twitter":1387,"linkedin":1388,"imageOffsetTop":1389,"imageOffsetLeft":1390},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1392,"avatar":1393,"permalink":1394,"linkedin":1395},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1397,"avatar":1398,"permalink":1399,"linkedin":1400,"twitter":1401},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1403,"avatar":1404,"permalink":1405,"linkedin":1406,"twitter":1407},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1409,"avatar":1410,"permalink":1411,"linkedin":1412,"twitter":1413},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1415,"avatar":1416,"permalink":1417,"linkedin":1418,"twitter":1419,"imageOffsetTop":1420,"imageOffsetLeft":1421},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1423,"avatar":1424,"permalink":1425,"twitter":1373,"linkedin":1426},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1428,"avatar":1429,"permalink":1430,"twitter":1373,"linkedin":1431},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1433,"avatar":1434,"permalink":1435,"twitter":1373,"linkedin":1426,"imageOffsetTop":1362},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1437,"avatar":1438,"permalink":1439,"twitter":1373,"linkedin":1440},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1442,"avatar":1443,"permalink":1444,"twitter":1445,"linkedin":1446},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1373,"linkedin":1426,"imageOffsetTop":1362},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1455,"linkedin":1455},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":524,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1460,"imageOffsetTop":1461},"people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1463,"avatar":1464,"permalink":1465,"linkedin":1466,"twitter":1373},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1468,"avatar":1469,"permalink":1470,"linkedin":1471,"twitter":1373},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1473,"avatar":1474,"permalink":1475,"twitter":1476,"linkedin":1477},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1479,"avatar":1480,"permalink":1481,"linkedin":1482,"twitter":1373},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487,"twitter":1373,"imageOffsetTop":1362},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"twitter":1373},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1494,"avatar":1495,"permalink":1496,"twitter":1373},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1498,"avatar":1499,"permalink":1500,"twitter":1373,"linkedin":1501},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1503,"avatar":1504,"permalink":1505,"twitter":1506,"linkedin":1507},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"twitter":1373},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1514,"avatar":1515,"permalink":1516,"twitter":1373,"linkedin":1426},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1518,"avatar":1519,"permalink":1520,"twitter":1521,"linkedin":1521,"imageOffsetTop":1362,"socials":1522},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1523,1526],{"text":1524,"href":1525},"Blog","https://emptydc.com",{"text":1527,"href":1528},"Podcast","https://hairlessinthecloud.com",{"display_name":1530,"avatar":1531,"permalink":1532,"twitter":1533,"linkedin":1534},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1536,"avatar":1537,"permalink":1538,"twitter":1373,"linkedin":1426},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1540,"avatar":1541,"permalink":1542,"twitter":1543,"linkedin":1426},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1545,"avatar":1546,"permalink":1547,"twitter":1548,"linkedin":1549},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1551,"avatar":1552,"permalink":1553,"twitter":1554,"linkedin":1554},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1556,"avatar":1557,"permalink":1558,"twitter":1559,"linkedin":1560},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1562,"avatar":1563,"permalink":1564,"twitter":1565,"linkedin":1566},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1568,"avatar":1569,"permalink":1570,"linkedin":1571,"twitter":1373},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1573,"avatar":1574,"permalink":1575,"linkedin":1576,"twitter":1373},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":523,"avatar":1578,"permalink":1579,"linkedin":1580,"twitter":1581},"people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1583,"avatar":1584,"permalink":1585,"linkedin":1586},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1588,"avatar":1589,"permalink":1590,"linkedin":1591},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1593,"avatar":1594,"permalink":1595,"linkedin":1596},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1598,"avatar":1599,"permalink":1600,"linkedin":1601},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1603,"avatar":1604,"permalink":1605,"linkedin":1606,"imageOffsetTop":1362},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1608,"avatar":1609,"permalink":1610,"linkedin":1611,"imageOffsetTop":1362},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":525,"avatar":1613,"permalink":1614,"linkedin":1615,"imageOffsetTop":1461},"people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1617,"avatar":1618,"permalink":1619,"linkedin":1620,"imageOffsetTop":1461},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1622,"avatar":1623,"permalink":1624,"linkedin":1625,"imageOffsetTop":1461},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1627,"avatar":1628,"permalink":1629,"linkedin":1630,"imageOffsetTop":1631,"imageOffsetLeft":1632},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1634,"avatar":1635,"permalink":1636,"linkedin":1637,"imageOffsetTop":1638,"imageOffsetLeft":1639},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1641,"avatar":1642,"permalink":1643,"linkedin":1644,"imageOffsetTop":1645,"imageOffsetLeft":1389},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1647,"Alexander Schlindwein":1648,"Sophie Luna":1649,"Nadine Klein":1650,"Karsten Kleinschmidt":1651,"Julian Wendt":1652,"Holger Bunkradt":1653,"Ralf Mania":1654,"Oliver Kieselbach":1655,"Steffen Schwerdtfeger":1656,"Gunnar Winter":1657,"Jan Petersen":1658,"Thorsten Kunzi":1659,"Moritz Pohl":1660,"Thorben Pöschus":1661,"Christoph Hannebauer":1662,"Marco Scheel":1663,"Christopher Brumm":1664,"Florian Klante":1665,"Niklas Bachmann":1666,"Nils Krautkrämer":1667,"Patrick Treptau":1668,"Peter Beckendorf":1669,"Patrick Sobau":1670,"Jörg Wunderlich":1671,"Michael Breither":1672,"Christian Kanja":1673,"Zeba Hoffmann":1674,"Jochen Fröhlich":1675,"Jan Geisbauer":1676,"Gerrit Reinke":1680,"Christian Kordel":1681,"Stephan Wälde":1682,"Carolin Kanja":1683,"Adrian Ritter":1684,"Marvin Bangert":1685,"Thorsten Pickhan":1686,"Christian Lorenz":1687,"Denis Böhm":1688,"Fabian Bader":1689,"Juan Jose Fernandez Perez":1690,"Mahschid Sayyar":1691,"Benjamin Dassow":1692,"Markus Walschburger":1693,"Jonathan Haist":1694,"Daniel Rohregger":1695,"Thomas Naunheim":1696,"Florian Stöckl":1697,"Pascal Asch":1698,"Markus Kättner":1699,"Anna Ulbricht":1700,"Annette Brauns":1701},{"display_name":1358,"avatar":1359,"permalink":1360,"linkedin":1361,"imageOffsetTop":1362},{"display_name":1364,"avatar":1365,"permalink":1366,"twitter":1367,"linkedin":1368},{"display_name":1370,"avatar":1371,"permalink":1372,"twitter":1373,"linkedin":1374,"imageOffsetLeft":1375,"imageOffsetTop":1376},{"display_name":1378,"avatar":1379,"permalink":1380,"twitter":1381,"linkedin":1382,"imageOffsetTop":1362},{"display_name":1384,"avatar":1385,"permalink":1386,"twitter":1387,"linkedin":1388,"imageOffsetTop":1389,"imageOffsetLeft":1390},{"display_name":1392,"avatar":1393,"permalink":1394,"linkedin":1395},{"display_name":1397,"avatar":1398,"permalink":1399,"linkedin":1400,"twitter":1401},{"display_name":1403,"avatar":1404,"permalink":1405,"linkedin":1406,"twitter":1407},{"display_name":1409,"avatar":1410,"permalink":1411,"linkedin":1412,"twitter":1413},{"display_name":1415,"avatar":1416,"permalink":1417,"linkedin":1418,"twitter":1419,"imageOffsetTop":1420,"imageOffsetLeft":1421},{"display_name":1423,"avatar":1424,"permalink":1425,"twitter":1373,"linkedin":1426},{"display_name":1428,"avatar":1429,"permalink":1430,"twitter":1373,"linkedin":1431},{"display_name":1433,"avatar":1434,"permalink":1435,"twitter":1373,"linkedin":1426,"imageOffsetTop":1362},{"display_name":1437,"avatar":1438,"permalink":1439,"twitter":1373,"linkedin":1440},{"display_name":1442,"avatar":1443,"permalink":1444,"twitter":1445,"linkedin":1446},{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1373,"linkedin":1426,"imageOffsetTop":1362},{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1455,"linkedin":1455},{"display_name":524,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1460,"imageOffsetTop":1461},{"display_name":1463,"avatar":1464,"permalink":1465,"linkedin":1466,"twitter":1373},{"display_name":1468,"avatar":1469,"permalink":1470,"linkedin":1471,"twitter":1373},{"display_name":1473,"avatar":1474,"permalink":1475,"twitter":1476,"linkedin":1477},{"display_name":1479,"avatar":1480,"permalink":1481,"linkedin":1482,"twitter":1373},{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487,"twitter":1373,"imageOffsetTop":1362},{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"twitter":1373},{"display_name":1494,"avatar":1495,"permalink":1496,"twitter":1373},{"display_name":1498,"avatar":1499,"permalink":1500,"twitter":1373,"linkedin":1501},{"display_name":1503,"avatar":1504,"permalink":1505,"twitter":1506,"linkedin":1507},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"twitter":1373},{"display_name":1514,"avatar":1515,"permalink":1516,"twitter":1373,"linkedin":1426},{"display_name":1518,"avatar":1519,"permalink":1520,"twitter":1521,"linkedin":1521,"imageOffsetTop":1362,"socials":1677},[1678,1679],{"text":1524,"href":1525},{"text":1527,"href":1528},{"display_name":1530,"avatar":1531,"permalink":1532,"twitter":1533,"linkedin":1534},{"display_name":1536,"avatar":1537,"permalink":1538,"twitter":1373,"linkedin":1426},{"display_name":1540,"avatar":1541,"permalink":1542,"twitter":1543,"linkedin":1426},{"display_name":1545,"avatar":1546,"permalink":1547,"twitter":1548,"linkedin":1549},{"display_name":1551,"avatar":1552,"permalink":1553,"twitter":1554,"linkedin":1554},{"display_name":1556,"avatar":1557,"permalink":1558,"twitter":1559,"linkedin":1560},{"display_name":1562,"avatar":1563,"permalink":1564,"twitter":1565,"linkedin":1566},{"display_name":1568,"avatar":1569,"permalink":1570,"linkedin":1571,"twitter":1373},{"display_name":1573,"avatar":1574,"permalink":1575,"linkedin":1576,"twitter":1373},{"display_name":523,"avatar":1578,"permalink":1579,"linkedin":1580,"twitter":1581},{"display_name":1583,"avatar":1584,"permalink":1585,"linkedin":1586},{"display_name":1588,"avatar":1589,"permalink":1590,"linkedin":1591},{"display_name":1593,"avatar":1594,"permalink":1595,"linkedin":1596},{"display_name":1598,"avatar":1599,"permalink":1600,"linkedin":1601},{"display_name":1603,"avatar":1604,"permalink":1605,"linkedin":1606,"imageOffsetTop":1362},{"display_name":1608,"avatar":1609,"permalink":1610,"linkedin":1611,"imageOffsetTop":1362},{"display_name":525,"avatar":1613,"permalink":1614,"linkedin":1615,"imageOffsetTop":1461},{"display_name":1617,"avatar":1618,"permalink":1619,"linkedin":1620,"imageOffsetTop":1461},{"display_name":1622,"avatar":1623,"permalink":1624,"linkedin":1625,"imageOffsetTop":1461},{"display_name":1627,"avatar":1628,"permalink":1629,"linkedin":1630,"imageOffsetTop":1631,"imageOffsetLeft":1632},{"display_name":1634,"avatar":1635,"permalink":1636,"linkedin":1637,"imageOffsetTop":1638,"imageOffsetLeft":1639},{"display_name":1641,"avatar":1642,"permalink":1643,"linkedin":1644,"imageOffsetTop":1645,"imageOffsetLeft":1389},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1705,"authors":1921},[1706,1722,1736,1750,1766,1779,1792,1805,1817,1833,1847,1862,1880,1891,1905],{"id":1707,"title":1708,"author":1709,"cta":494,"description":1296,"hideInRecent":484,"layout":1319,"meta":1710,"moment":1715,"path":1716,"stem":1717,"tags":1718,"webcast":484},"content_ja/posts/2026-09-22-end-of-mfa-sms.md","MFA向けSMSの終わり",[1384],{"lang":1321,"date":1711,"categories":1712,"blogtitlepic":1713,"customExcerpt":1714},"2026-09-21",[235],"head-conditional-access.jpg","企業がいまフィッシング耐性のある、できるだけパスワードレスな認証方式へ移行すべき理由。","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1719,1350,1720,1721],"Authentication","MFA","Passkeys",{"id":1723,"title":1724,"author":1725,"cta":494,"description":1296,"hideInRecent":484,"layout":1319,"meta":1726,"moment":1711,"path":1730,"stem":1731,"tags":1732,"webcast":484},"content_ja/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix。ユーザー自身がエクスプロイトになるとき、そしてそれを止める方法",[1358,1378],{"lang":1321,"date":1711,"categories":1727,"blogtitlepic":1728,"customExcerpt":1729},[235],"head-clickfix.jpg","ClickFixはユーザーを自分自身への攻撃者に変えます。偽のCAPTCHA、コピー＆ペースト、そして悪意あるコードがメモリ上で走り、ディスクには何も残りません。Microsoft Defenderがこの攻撃をどう検知するのか、検知はどこで限界に達するのか、そしてRunMRUハントと4つの防御レイヤーでその隙間をどう埋めるのかを解説します。","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1733,1734,1735],"Defender","SOC","Endpoint Security",{"id":1737,"title":1738,"author":1739,"cta":494,"description":1296,"hideInRecent":484,"layout":1319,"meta":1740,"moment":1711,"path":1744,"stem":1745,"tags":1746,"webcast":484},"content_ja/posts/2026-09-21-red-tenant-dark-tenant-cio.md","管理業務と日常業務を1台のPCで。Game Overです。",[1518],{"lang":1321,"date":1711,"categories":1741,"blogtitlepic":1742,"customExcerpt":1743},[235],"head-game-over-en.jpg","CIOにとってテナントが1つでは足りない理由と、2つ目がめったに検討されない理由。Managed Red Tenantは管理業務をオフィス環境からアーキテクチャとして分離し、Managed Dark Tenantは防御が破られてもなお組織が動き続けられるようにします。それが運用モデル、SOCのシグナル、そしてNISG 2026による証明義務にとって何を意味するのかを解説します。","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1747,1748,1749],"Privileged Access","Zero Trust","NIS2",{"id":1751,"title":1752,"author":1753,"cta":494,"description":1754,"hideInRecent":484,"layout":1319,"meta":1755,"moment":1756,"path":1761,"stem":1762,"tags":1763,"webcast":484},"content_ja/posts/2026-08-08-isg-germany-2026.md","4度のLeader。ISGドイツ調査2026のglueckkanja",[1545],"ISGは今年、調査の名称を変更しました。Microsoft Cloud EcosystemはMicrosoft AI and Cloud Ecosystemになり、名称とともに評価の尺度も移りました。問われるのはもはや、誰がMicrosoftプラットフォームを導入したかではなく、誰がCopilot、エージェント、AIワークロードを制御可能なかたちで運用しているかです。この新しい尺度によって当社の位置づけが変わることはありませんでした。ISG Provider Lens®調査ドイツ2026は、当社を4つのクアドラントでLeaderに位置づけています。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。2021年、2023年、2024年、2025年に続き、ドイツでは5回目のLeader評価となります。スイスでのLeaderクアドラント入りはその2週間前でした。",{"lang":1321,"date":1756,"categories":1757,"blogtitlepic":1759,"customExcerpt":1760},"2026-08-08",[1758],"Corporate","head-isg-de-2026.png","ISG Provider Lens®調査2026は、ドイツにおいてglueckkanjaを4つのクアドラントでLeaderに位置づけました。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。調査の名称はMicrosoft AI and Cloud Ecosystemに変わり、評価の尺度も移りました。AIとエージェントのワークロードを制御可能なかたちで運用できるかが問われています。","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1764,1765],"Award","ISG",{"id":1767,"title":1768,"author":1769,"cta":494,"description":1770,"hideInRecent":484,"layout":1319,"meta":1771,"moment":1772,"path":1776,"stem":1777,"tags":1778,"webcast":484},"content_ja/posts/2026-07-31-isg-switzerland-2026.md","Rising StarからLeaderへ。ISGスイス調査2026のglueckkanja",[1545],"2024年に当社はglueckkanja Switzerland AGを設立し、ベルンのBahnhofplatz 10bにあるzentroomにオフィスを構えました。2025年、ISGはスイス市場で当社をRising Starに位置づけました。アナリストがLeaderクアドラントへの躍進を見込むベンダーという位置づけです。その躍進がいま記録されました。ISG Provider Lens®調査2026は、スイスにおいて当社をMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけています。",{"lang":1321,"date":1772,"categories":1773,"blogtitlepic":1774,"customExcerpt":1775},"2026-07-31",[1758],"head-isg-ch-2026.png","ISG Provider Lens®調査2026は、スイスにおいてglueckkanjaをMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけました。ベルンでの市場参入から2年、Rising Star選出から1年でのことです。","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1764,1765],{"id":1780,"title":1781,"author":1782,"cta":494,"description":1296,"hideInRecent":484,"layout":1319,"meta":1783,"moment":1784,"path":1788,"stem":1789,"tags":1790,"webcast":484},"content_ja/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak。OpenAI／Hugging Faceの事案が示すこと、示さないこと",[1518],{"lang":1321,"date":1784,"categories":1785,"blogtitlepic":1786,"customExcerpt":1787},"2026-07-24",[235],"head-outbreak.jpg","AIエージェントがテスト環境から脱出し、ゼロデイを見つけ、別の企業をハッキングする。映画の脚本のようですが、2026年7月に実際に起きました。冷静に位置づける時期です。少しの心理学、2人のセキュリティ専門家、そしてそれが自社の防御にとって何を意味するのかという問いとともに。","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1791,1734,1748],"AI",{"id":1793,"title":1794,"author":1795,"cta":494,"description":1796,"hideInRecent":484,"layout":1319,"meta":1797,"moment":1798,"path":1802,"stem":1803,"tags":1804,"webcast":484},"content_ja/posts/2026-07-22-isg-cybersecurity-2026.md","LeaderそしてRising Star。ISGサイバーセキュリティ調査2026のglueckkanja",[1545],"新たに加わったクアドラントで、いきなりLeaderになりました。ISG Provider Lens®調査「Cybersecurity – Services and Solutions 2026」は、ドイツの中堅中小企業向けNext-Gen SOC/MDR Services分野でglueckkanjaをLeaderと位置づけています。Next-Gen SOC/MDR Servicesの全体市場では、ISGは当社をRising Starに選出しました。つまり、今後12か月から24か月のうちにLeaderクアドラントへ躍進するとアナリストが見込むベンダーだということです。",{"lang":1321,"date":1798,"categories":1799,"blogtitlepic":1800,"customExcerpt":1801},"2026-07-22",[1758],"head-isg-cybersecurity-2026.png","ISG Provider Lens®調査 Cybersecurity 2026は、glueckkanjaをNext-Gen SOC/MDR Services（Midmarket）クアドラントのLeaderに選出しました。Next-Gen SOC/MDR Servicesの全体市場では、当社はRising Starです。ISGは当社の平均を上回る成長、Microsoftセキュリティに関する深い専門性、そしてドイツ国内から提供する24時間365日のSOCを評価しています。","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1764,1765,235],{"id":1806,"title":1807,"author":1808,"cta":494,"description":1809,"hideInRecent":484,"layout":1319,"meta":1810,"moment":1811,"path":1814,"stem":1815,"tags":1816,"webcast":484},"content_ja/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity：AIが実際に働くために本当に必要なもの",[1545],"ある製造業の企業が、14,000あるSKUのうちどれが実際に利益を生んでいるのかを知りたいと考えました。答えは3つのシステムの中にありますが、それらは一度もデータを1件たりともやり取りしたことがありません。少し前までは、その答えを得るのに3つの部門、2週間、そして相当な善意が必要でした。2026年初頭からは、AIがこの問いに数分で答えられます。データを走査し、関連を結び、推奨を出す。ただし、アクセスできることが前提です。",{"lang":1321,"date":1811,"categories":1812,"blogtitlepic":1813},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1791,131],{"id":1818,"title":1819,"author":1820,"cta":494,"description":1821,"hideInRecent":484,"layout":1319,"meta":1822,"moment":1823,"path":1827,"stem":1828,"tags":1829,"webcast":484},"content_ja/posts/2026-07-01-onboarding-process.md","契約書にサインしたあと：当社のオンボーディングはこう進みます",[1634],"オンボーディングは実際どう進むのですか。応募者との会話で繰り返し受ける質問です。オンボーディングがぎくしゃくした経験を持つ人が少なくないからでしょう。だからこそ当社は、最初から安心してもらうことを大切にしています。",{"lang":1321,"date":1823,"categories":1824,"blogtitlepic":1825,"customExcerpt":1826},"2026-07-01",[1758],"Onboarding_Blogheader","契約書にサインが済み、大きな一歩は終わりました。では、ここからどうなるのでしょうか。PreBoardingからチームでの最初の1週間まで、当社のオンボーディングの舞台裏をご案内します。","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1830,1831,1832],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1834,"title":1835,"author":1836,"cta":494,"description":1837,"hideInRecent":484,"layout":1319,"meta":1838,"moment":1839,"path":1843,"stem":1844,"tags":1845,"webcast":484},"content_ja/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner：当社もその一員です",[1545],"Microsoftのパートナーエコシステムには数多くの表彰がありますが、Frontier Partner Badgeはその成り立ちにおいて他の称号と一線を画します。申請することはできず、Microsoft側の主導で、ごく限られたパートナーに授与されます。対象となるには、1つの領域で秀でるのではなく、複数の領域で同時に実力を示さなければなりません。Microsoftが確認するのは、Cloud & AI Platforms、AI Business Solutions、そしてSecurityにおける実証済みの能力です。つまり対象は、AIを既存のITへの後付けではなく、IDからエンドポイント、そして本番のAI運用までを貫くアーキテクチャの帰結として捉えている企業です。",{"lang":1321,"date":1839,"categories":1840,"blogtitlepic":1841,"customExcerpt":1842},"2026-06-26",[1758],"head-frontier-partner-badge.jpg","最近、Microsoft AI Cloud Partner Programに新たな最高位の称号としてFrontier Partner Badgeが設けられました。Microsoftがこれを授与するのは、ワークプレイスからクラウドプラットフォーム、セキュリティ、そしてAIアプリケーションそのものに至るまで、Microsoftスタック全体でAIプロジェクトを確実に届けられると実績で示した、世界でもごく限られたパートナーだけです。DACH圏でこのグループに属するのは数社にすぎず、当社はそのうちの1社です。","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1764,1846,1791],"Microsoft Partner",{"id":1848,"title":1849,"author":1850,"cta":494,"description":1851,"hideInRecent":484,"layout":1319,"meta":1852,"moment":1853,"path":1857,"stem":1858,"tags":1859,"webcast":484},"content_ja/posts/2026-06-09-vair-run.md","チャリティのために160キロ",[1641],"日曜の朝8時30分、マイン川沿いのHolbeinsteg。おそろいのNinjaCatシャツを着た11人の同僚が、Frankfurter Rundenのスタートに並びました。雨も雷鳴も込みです。良いことのために走るという動機は、悪天候でもランニングシューズの紐を結ぶのに十分でした。",{"lang":1321,"date":1853,"categories":1854,"blogtitlepic":1855,"customExcerpt":1856},"2026-06-08",[1758],"frankfurter-runden.png","同僚11人、16周、160キロ、雷雨、そして表彰台。glueckkanjaはFrankfurter Runden 2026に参加し、走った1周ごとにVAIR e.V.へ寄付しました。同団体はオフェンバッハでインクルーシブなスポーツ・カルチャーパークを建設しています。","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1860,1830,1861],"Top Arbeitgeber","Soziales Engagement",{"id":1863,"title":1864,"author":1865,"cta":494,"description":1866,"hideInRecent":484,"layout":1319,"meta":1867,"moment":1868,"path":1872,"stem":1873,"tags":1874,"webcast":484},"content_ja/posts/2026-04-10-incident-to-intelligence.md","未知のAMOSスティーラーの解剖：アラートから免疫獲得まで数時間",[1622],"当社のSOCでアラートが発報すると、そこから時計が動き始めます。対象となったお客様だけでなく、当社の保護下にあるすべての組織にとってです。現代の脅威環境で最も危険な瞬間はインテリジェンス・ギャップ、つまり新しいマルウェア亜種が最初に投入されてから、業界がその存在を知る日までの時間の窓です。",{"lang":1321,"date":1868,"categories":1869,"blogtitlepic":1870,"customExcerpt":1871},"2026-04-10",[235],"head-amos-stealer.png","これまで文書化されていなかったAMOSスティーラーの亜種が、macOSエンドポイントを侵害しました。既知のハッシュはなく、公開データベースにC2データもありません。当社のSOCは6層の難読化を解体し、すべての指標を抽出したうえで、業界がこの検体を目にするよりも前に、数時間以内ですべてのSOCのお客様へ保護を配布しました。","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1875,1876,1877,1878,1879],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1881,"title":1882,"author":1883,"cta":494,"description":1884,"hideInRecent":484,"layout":1319,"meta":1885,"moment":1886,"path":1889,"stem":1890,"tags":494,"webcast":484},"content_ja/posts/2026-03-21-microsoft-edge-corporate-browser.md","Edgeを唯一の社内標準ブラウザーにすべき理由",[1415],"企業環境におけるブラウザーの選定は戦略的な判断です。セキュリティの水準と運用の手間を直接左右します。長らくGoogle Chromeが自然な選択肢でしたが、Microsoft Edgeは既存のスタックに直接組み込まれるブラウザーへと進化しました。特にMicrosoft 365を利用し、管理をIntuneで行っている環境ではその効果が大きくなります。",{"lang":1321,"date":1886,"blogtitlepic":1887,"customExcerpt":1888},"2026-03-21","head-microsoft-edge-default-browser.jpg","Chromeを本気で選んだ企業はほとんどありません。独自の同期ロジック、独自のアカウント管理、独自のポリシー画面を抱えたまま、ただそこにあっただけです。一方でMicrosoft Edgeは、すでに動いているインフラ、つまりEntra ID、Intune、Defenderに直接組み込まれます。本記事では、移行がどのようなものか、IntuneのポリシーでどのようにChromeをランディングページへリダイレクトするか、そして2つのブラウザーを並行運用するのをやめると何が不要になるかを紹介します。","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1892,"title":1893,"author":1894,"cta":494,"description":1895,"hideInRecent":484,"layout":1319,"meta":1896,"moment":1897,"path":1901,"stem":1902,"tags":1903,"webcast":484},"content_ja/posts/2026-03-20-stryker-attack-intune-privilege.md","必要だったのは管理者アカウント1つだけでした",[1518],"2026年3月11日水曜日。79か国のStrykerのオフィスで従業員がPCの電源を入れると、中身は空でした。ログイン画面はロゴに置き換わっていました。社用ノートPC、社用スマートフォン、そして同社のBYODプログラムに登録されていた私物端末まで、すべてが一夜のうちに同時に消去されました。ランサムウェアもマルウェアのシグネチャも、エンドポイント検知ツールが捉えられるものは何もありませんでした。",{"lang":1321,"date":1897,"categories":1898,"blogtitlepic":1899,"customExcerpt":1900},"2026-03-20",[235],"head-stryker.jpg","2026年3月11日、Handalaは79か国の端末を消去しました。そのために必要だったのは、侵害されたIntuneの管理者アカウント1つだけです。マルウェアもエクスプロイトもなく、正規の管理ツールが所有者自身に向けられました。何が起きたのか、なぜそれが通用したのか、そして塞ぐべき2つのアーキテクチャ上の穴について説明します。","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[1904,71,1747,1748],"Red Tenant",{"id":1906,"title":1907,"author":1908,"cta":494,"description":1909,"hideInRecent":484,"layout":1319,"meta":1910,"moment":1911,"path":1915,"stem":1916,"tags":1917,"webcast":484},"content_ja/posts/2026-03-16-ai-agent-hackathon.md","6つのAgent。4週間。実際の運用へ。",[1545],"自社のIT部門は、Agentなら数分で片づく作業に毎週何時間を費やしているでしょうか。",{"lang":1321,"date":1911,"categories":1912,"blogtitlepic":1913,"customExcerpt":1914},"2026-03-16",[1758],"head-ai-agent-hackathon.jpg","6社、4週間のビルドフェーズ、6つの動作するAI Agent。これが第1回glueckkanja AI Agent Hackathonの成果です。Kiekert、Dr. Oetker、Eckes-Granini、igefa、lila logistikがCopilot StudioでAgentを構築し、それらは現在すでに本番で稼働しています。そこで何が生まれ、この形式がどのように機能するのかを紹介します。","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1791,1918,1919,1920],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1922,"Fritz Zurhorst":1923,"Nadine Klein":1924,"Jan Geisbauer":1925,"Carolin Kanja":1929,"Anna Ulbricht":1930,"Annette Brauns":1931,"Pascal Asch":1932,"Steffen Schwerdtfeger":1933},{"display_name":1384,"avatar":1385,"permalink":1386,"twitter":1387,"linkedin":1388,"imageOffsetTop":1389,"imageOffsetLeft":1390},{"display_name":1358,"avatar":1359,"permalink":1360,"linkedin":1361,"imageOffsetTop":1362},{"display_name":1378,"avatar":1379,"permalink":1380,"twitter":1381,"linkedin":1382,"imageOffsetTop":1362},{"display_name":1518,"avatar":1519,"permalink":1520,"twitter":1521,"linkedin":1521,"imageOffsetTop":1362,"socials":1926},[1927,1928],{"text":1524,"href":1525},{"text":1527,"href":1528},{"display_name":1545,"avatar":1546,"permalink":1547,"twitter":1548,"linkedin":1549},{"display_name":1634,"avatar":1635,"permalink":1636,"linkedin":1637,"imageOffsetTop":1638,"imageOffsetLeft":1639},{"display_name":1641,"avatar":1642,"permalink":1643,"linkedin":1644,"imageOffsetTop":1645,"imageOffsetLeft":1389},{"display_name":1622,"avatar":1623,"permalink":1624,"linkedin":1625,"imageOffsetTop":1461},{"display_name":1415,"avatar":1416,"permalink":1417,"linkedin":1418,"twitter":1419,"imageOffsetTop":1420,"imageOffsetLeft":1421},{"id":1353,"extension":1354,"meta":1935,"stem":8,"__hash__":1703},{"Christopher Brumm":1936,"Fabian Bader":1937,"Thomas Naunheim":1938},{"display_name":524,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1460,"imageOffsetTop":1461},{"display_name":523,"avatar":1578,"permalink":1579,"linkedin":1580,"twitter":1581},{"display_name":525,"avatar":1613,"permalink":1614,"linkedin":1615,"imageOffsetTop":1461},1791383937052]