A novel proof-of-concept (PoC) cyberattack technique is capable of preventing Windows Defender from receiving updates without exploiting a vulnerability in the process.
Dubbed "BigDiskBuster" by researchers from LevelBlue, the PoC was originally published on Sept. 19 by security researcher and former Microsoft employee Abdelhamid Naceri, who goes by MSNightmare (aka Nightmare-Eclipse). The GitHub page for the PoC has since been taken down, but LevelBlue researchers were able to reproduce it. Naceri compared BigDiskBuster to UnDefend, another PoC he published, which similarly prevents Defender from keeping up-to-date detection content.
BigDiskBuster Blocks Defender Updates
Today's blog post describes LevelBlue's efforts to reproduce the PoC, which appears somewhat simple on the surface. As research authors Serhii Melnyk and Timmy Lister explained, BigDiskBuster "watches the C:\ volume for Defender update activity and, when an update begins, creates a hidden file that claims essentially all available free space."
With essentially all available disk space claimed, the Defender update fails. Defender then cleans up the staging directory, makes the space available, and BigDiskBuster repeats the process on Defender's next update attempt. "The important part is what does not happen. Defender's service keeps running, and real-time protection remains active. There is no obvious product failure — only an update process that quietly stops keeping the endpoint current," Melnyk and Lister wrote.
LevelBlue's testing of the technique was successful, and on a live Defender platform update, researchers created what the blog post described as a "silent detection gap," in which Defender continues to operate and appears healthy yet is not receiving updates.