As cited
Copy frozen at (site build).
threat intel
'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
A proof-of-concept technique called BigDiskBuster maintains the appearance of Microsoft Defender running while blocking security updates, creating an undetected vulnerability window. The method requires no exploit and operates silently, leaving the service seemingly functional while detection gaps persist.
Why it matters: Organizations relying on Microsoft Defender may believe they are protected when the service is actually running with outdated definitions and patches. Security teams should verify that both Defender itself and its definitions update successfully, not just confirm the service is running.
- Source published
- First seen by Cybersecurity Tracker