GoKawiilPoC tool 'BigDiskBuster' blocks Windows Defender updates while keeping it running
Security researcher Abdelhamid Naceri published a proof-of-concept called BigDiskBuster that stops Microsoft Defender from receiving signature updates without exploiting any vulnerability. The roughly 300-line C++ tool monitors the C: drive for Defender update activity and fills nearly all free disk space with a hidden file, causing each update attempt to fail while Defender's service and real-time protection keep running normally. LevelBlue researchers reproduced the technique after the original GitHub page was taken down, confirming it creates what they called a 'silent detection gap.'