'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates

A proof-of-concept named BigDiskBuster interferes with Microsoft Defender updates by watching the Defender staging volume and creating hidden files that claim nearly all free disk space when an update begins, causing updates to fail while real-time protection continues to run. LevelBlue reproduced the PoC (originally published by MSNightmare), found it can run from a standard user account, detailed the four core mechanisms used, and published I/O-level indicators and detection guidance (e.g., repeated 0x80070643 update failures and unusual handle or hidden disk-allocation behavior).