BigDiskBuster Blocks Microsoft Defender Updates While Service Runs

Researchers detailed BigDiskBuster, a proof-of-concept technique that leaves Microsoft Defender running but silently blocks its updates, creating a virus detection gap. No exploit is required.

• Technique doesn't kill EDR, only blocks Defender updates
• Defender service keeps running, masking the detection gap
• No exploit required — it's a proof-of-concept
• Antivirus signature updates stop arriving silently