'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates

BigDiskBuster proof of concept keeps Microsoft Defender running while blocking updates and opening a detection gap.

Dark Reading reports on BigDiskBuster, a proof-of-concept technique that is not a full EDR killer. It leaves the Microsoft Defender service running normally while blocking updates, creating a silent gap in virus detection. The available report says no exploit is required and does not identify a CVE, victim, or observed real-world use.

• BigDiskBuster is described as a proof of concept, not a full EDR killer.
• Microsoft Defender keeps running while its updates are blocked.
• The result is a silent virus-detection gap.
• The report says no exploit is required.