BigDiskBuster: The Stealth Attack That Silently Disarms Microsoft Defender
In October 2026, security researcher Abdelhamid Naceri (MSNightmare) released a proof-of-concept technique called 'BigDiskBuster' that prevents Microsoft Defender from receiving security updates without exploiting any vulnerabilities. The technique monitors Defender update activity and creates hidden files that consume all available disk space when updates begin, causing silent update failures while leaving the antivirus service running normally. LevelBlue researchers successfully reproduced the attack, demonstrating how it creates a 'silent detection gap' where Defender appears healthy but becomes increasingly vulnerable to new threats as its signature database becomes outdated. This incident highlights the growing sophistication of EDR evasion techniques and the critical need for organizations to monitor not just whether security tools are running, but whether they're receiving current threat intelligence updates.
Kill Chain
