[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsXTSiigk0GO89e-d7nVuQPdnq-WMWt--5y-X5DA_-0U":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"16e0befa-1130-4b61-8ab9-d3330fabb3d9","'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates","bigdiskbuster-leaves-microsoft-defender-running-while-blocking-updates-220ffe","Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.","A new proof-of-concept technique called 'BigDiskBuster' has been demonstrated that can create a silent gap in virus detection by preventing Microsoft Defender from updating its definitions. This method doesn't require exploits and allows the antivirus service to appear to be running normally, making it difficult to detect the compromise.","BigDiskBuster technique bypasses Microsoft Defender by blocking updates while remaining undetected.","https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fbigdiskbuster-microsoft-defender-running-blocking-updates","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt3886ee964b5d16f1\u002F6ac4000875ac86196ed5f175\u002Fbroken_hard_drive-Bryngelzon-GettyImages-115958814.jpg?width=720&quality=80&disable=upscale","2026-10-06T16:59:24+00:00","2026-10-06T18:00:22.331565+00:00",7,[17,20],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":22},"EDR","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":44,"vendors":124},[45,66,95],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[50,58],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":67,"name":68,"problem":69,"products":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":96,"name":97,"problem":98,"products":99},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",[125],{"slug":51,"name":52,"logo_path":53,"roles":126},[127],"affected",{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":142},"bigdiskbuster-silently-blocks-defender-updates-while-appearing-healthy","BigDiskBuster Silently Blocks Defender Updates While Appearing Healthy","The BigDiskBuster technique exploits a gap in how Microsoft Defender validates its own update pipeline, allowing an attacker to freeze antivirus definitions without triggering any visible alerts — the service continues to appear fully operational. This is dangerous because a stale definition database leaves endpoints blind to newly discovered malware, effectively nullifying the protection organizations rely on. The stealthy nature of the attack means security teams may have no indication their endpoint protection has been degraded for an extended period. This highlights that 'running' does not equal 'effective' — health checks must validate functional outcomes, not just service status.",[133,134,135,136,137,138,139,140,141],"CIS Control 10: Malware Defenses","CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","ISO\u002FIEC 27001 A.12.2: Protection from Malware",{}]