'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates

A new proof-of-concept technique dubbed 'BigDiskBuster' has been identified, which allows attackers to disrupt Microsoft Defender's update mechanism without disabling the security service itself. By exploiting how the software manages disk space and update processes, the technique creates a silent detection gap. The security tool continues to run and report normal status to the user, but it fails to receive the latest threat intelligence signatures, leaving the system vulnerable to new exploits. Unlike traditional EDR-killer tools that attempt to terminate security processes, BigDiskBuster operates by manipulating the environment to prevent updates, making it harder for automated monitoring systems to detect the compromise. Security researchers highlight that this method requires no specific exploit, relying instead on the inherent logic of the update service. Organizations are advised to monitor for unusual disk activity and ensure that security updates are successfully applied across their infrastructure.