'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
BLUF
Attackers can silently disable antivirus updates without stopping the service or triggering alerts.
NEWS
A recent proof-of-concept demonstrates how BigDiskBuster prevents Microsoft Defender from receiving critical patches while maintaining a healthy service status. The method requires no system exploits, relying on configuration manipulation to create a detection gap.
Why I Care
This undermines endpoint security by creating a false sense of safety where protection appears active but cannot detect new threats. Enterprises relying on Defender for compliance and threat mitigation face heightened exposure to known vulnerabilities.
Next Steps
Security teams must audit Defender update logs immediately to confirm patching integrity. IT administrators should enforce strict group policies restricting modification of update settings within the next 7 days.
Source: Dark Reading ·