[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC9_CECGcvxRBY_ouFblhnrozerR9GI__u63-5oFH8Z8":3},{"article":4,"iocs":36,"watch_terms":40},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":10,"url":11,"image_url":10,"published_at":12,"ingested_at":13,"relevance_score":14,"entities":15,"category_id":16,"category":17,"article_tags":20},"3ef89cc5-e975-4b9d-8d8f-cd815a585ef1","Defender Tip: Monitor for vol.exe or python.exe interacting with memory dump files in user temp f...","defender-tip-monitor-for-vol-exe-or-python-exe-interacting-with-memory-dump-file","Defender Tip: Monitor for vol.exe or python.exe interacting with memory dump files in user temp folders. If you see Hashdump in your logs and it isn't your IR team... you have a live intrusion.\n\nWant more info? Get in touch!","Microsoft Defender guidance recommends monitoring for suspicious interactions between forensic tools (vol.exe, python.exe) and memory dump files in user temp directories as indicators of active compromise. Detection of Hashdump artifacts in logs—outside authorized IR activities—signals an ongoing intrusion attempt, likely focused on credential extraction.",null,"https:\u002F\u002Fx.com\u002FTheDFIRReport\u002Fstatus\u002F2034680675693985883","2026-03-19T17:17:30+00:00","2026-03-19T18:00:19.175753+00:00",8,[],"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73",{"id":16,"icon":10,"name":18,"slug":19},"Incident Response","incident-response",[21,26,31],{"category":22},{"id":23,"icon":10,"name":24,"slug":25},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":27},{"id":28,"icon":10,"name":29,"slug":30},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":32},{"id":33,"icon":10,"name":34,"slug":35},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[37],{"type":30,"value":38,"context":39},"Hashdump","Credential dumping utility; presence in logs indicates active intrusion if not authorized IR activity",[]]