Security researcher NightmareEclipse has developed a proof-of-concept exploit named BigDiskBuster, designed to block automatic updates for Microsoft Defender. The tool prevents the installation of new software modules and signature databases while running in the background.
The exploit functions by monitoring the update process and filling disk space with temporary hidden files to trigger an installation failure. Additionally, it locks the MRT.exe executable, which is part of the Microsoft Malicious Software Removal Tool, preventing other processes from accessing it.
According to the researcher, the tool is compatible with all supported versions of Windows, though it currently contains bugs and requires further refinement. The exploit causes the update process to return the standard 0x80070643 error code.
While the tool does not disable Microsoft Defender entirely, it forces the antivirus to operate with outdated databases, leaving the system vulnerable to newly discovered threats. Independent security experts have not yet verified the functionality of BigDiskBuster.
