GoKawiilPoC tool 'BigDiskBuster' blocks Windows Defender updates while keeping it running
Security researcher Abdelhamid Naceri published a proof-of-concept called BigDiskBuster that stops Microsoft Defender from receiving signature updates without exploiting any vulnerability. The roughly 300-line C++ tool monitors the C: drive for Defender update activity and fills nearly all free disk space with a hidden file, causing each update attempt to fail while Defender's service and real-time protection keep running normally. LevelBlue researchers reproduced the technique after the original GitHub page was taken down, confirming it creates what they called a 'silent detection gap.'
GoKawiil's interpretation of the reporting above, not reported fact.
Because Defender shows no visible failure and continues running, administrators monitoring only service status could be unaware that protection content has gone stale, leaving systems exposed to newer threats. The technique's reliance on normal filesystem behavior rather than a software bug suggests it could be harder for Microsoft to patch outright, potentially requiring changes to how update failures are surfaced or monitored. LevelBlue's reproduction indicates the method is realistic enough for defenders to need detection strategies beyond simple service-status checks.
- BigDiskBuster prevents Microsoft Defender updates by filling disk space, without exploiting any flaw.
- Defender's service and real-time protection keep running, masking the fact that updates are failing.
- LevelBlue reproduced the PoC after its GitHub page was removed, confirming a 'silent detection gap.'
Samsung T7 Portable SSD — If disk space tricks can be weaponized to block critical security updates, it's worth having ample free storage headroom on your system. Offloading large files to an external SSD like the Samsung T7 keeps your main drive from running dangerously low on space, which helps ensure Windows Defender and other update processes always have room to work. It's fast, compact, and a smart addition to any security-conscious setup.
See Samsung T7 Portable SSD on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Alexander Culafi, 2026-10-06
Published there as: “'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.