'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
BigDiskBuster technique bypasses Microsoft Defender by blocking updates while remaining undetected.
A new proof-of-concept technique called 'BigDiskBuster' has been demonstrated that can create a silent gap in virus detection by preventing Microsoft Defender from updating its definitions. This method doesn't require exploits and allows the antivirus service to appear to be running normally, making it difficult to detect the compromise.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Defender?
Get an email when a new story names Microsoft Defender, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe BigDiskBuster technique exploits a gap in how Microsoft Defender validates its own update pipeline, allowing an attacker to freeze antivirus definitions without triggering any visible alerts — the service continues to appear fully operational. This is dangerous because a stale definition database leaves endpoints blind to newly discovered malware, effectively nullifying the protection organizations rely on. The stealthy nature of the attack means security teams may have no indication their endpoint protection has been degraded for an extended period. This highlights that 'running' does not equal 'effective' — health checks must validate functional outcomes, not just service status.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.