Proof‑of‑Concept Malware Skips Defender Updates While Keeping Antivirus Service Running

Security researchers have demonstrated a proof‑of‑concept tool named BigDiskBuster that can stop Microsoft Defender from receiving its regular definition and engine updates, even though the antivirus service continues to appear operational on the host system.

The technique does not rely on a vulnerability or exploit; instead, it manipulates the way the operating system accesses the files that contain update data, effectively creating a silent gap where malicious code can reside undetected while the protection software seems active.

Microsoft Defender, the default anti‑malware solution bundled with Windows, depends on frequent updates to stay current against emerging threats. By intercepting or blocking the download and installation of these updates, BigDiskBuster undermines the core strength of the product without triggering the usual alerts that administrators monitor.

While the tool falls short of the more aggressive “EDR‑killer” malware that outright disables endpoint detection and response agents, its ability to keep the antivirus service running while starving it of fresh signatures produces a comparable risk: a window of invisibility for malicious activity that traditional monitoring may miss.

The discovery highlights a broader challenge for organizations that rely heavily on built‑in security suites. Without additional layers of verification—such as independent health checks of update pipelines or supplemental behavioral monitoring—an attacker could maintain a foothold while the primary defense appears intact.

Microsoft has not issued a specific advisory about BigDiskBuster, but the company regularly releases patches and guidance for protecting update mechanisms. Security teams are advised to audit the integrity of Defender update logs, employ network‑level controls that validate download sources, and consider complementary endpoint solutions that can detect anomalous file‑system activity.

Analysts expect the research community to develop detection signatures for the behavior exhibited by BigDiskBuster, and enterprises may begin to incorporate more rigorous verification steps into their patch‑management processes. The episode serves as a reminder that even well‑known security tools can be subverted through indirect means, reinforcing the need for layered, defense‑in‑depth strategies.