Yes. In a scenario reproduced by LevelBlue researchers, BigDiskBuster caused Microsoft Defender updates to fail while the Defender service and real-time protection kept running. That means a running service is not proof that security intelligence and platform updates are current; it does not mean Defender was fully disabled or that every layer of protection stopped.
How BigDiskBuster interferes with Defender updates
Dark Reading reported on October 6, 2026, that the proof of concept watches the C: volume for Defender update activity. When an update begins, it creates a hidden file that consumes nearly all available free disk space. The update then fails. According to the report, Defender clears its staging directory afterward, making room for the next attempt and allowing the cycle to repeat.
The technique was originally published on September 19 by Abdelhamid Naceri, also known as MSNightmare or Nightmare-Eclipse. Dark Reading says the GitHub page had since been taken down and that LevelBlue researchers reproduced the technique. The report describes testing on standard, out-of-the-box Defender installations and says the proof of concept could run under a standard user account; it does not establish that every Windows version or configuration is affected. Dark Reading’s report
What stays active—and what becomes stale
In LevelBlue’s reported reproduction, the Defender service kept running and real-time protection remained active even as updates failed. The distinction is between protection that is currently operating and protection content that is being kept current: a machine may still have real-time protection enabled while missing newer security intelligence or platform updates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
LevelBlue researchers described the result as a “silent detection gap.” That phrase refers to the risk of not receiving new detection content, not proof that Defender is entirely disabled or that the endpoint has no protection at all. As the researchers wrote, quoted by Alexander Culafi in Dark Reading: “The important part is what does not happen. Defender’s service keeps running, and real-time protection remains active. There is no obvious product failure — only an update process that quietly stops keeping the endpoint current.”
What administrators should check
Check successful update events and the recency of Defender’s security intelligence and platform updates rather than relying only on service status. LevelBlue researchers identified repeated update failures—particularly error 0x80070643—alongside unusual handle activity or hidden disk allocation as signals worth investigating. A single update error or a low-disk warning by itself does not establish that BigDiskBuster is present. Dark Reading
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A technical threat summary also describes monitoring Defender update directories and holding a restrictive handle on MRT.exe; these are details reported in secondary coverage, not independent findings established here. LevelBlue’s technical summary
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Microsoft said
Dark Reading quoted an unnamed Microsoft spokesperson as saying Defender Antivirus includes detections and preventions against the proof of concept, and advising customers to keep security intelligence and platform updates current. The spokesperson said: “Customers should keep Microsoft Defender security intelligence and platform updates current and update to the latest available security intelligence.” This is Microsoft’s statement as reported by Dark Reading, not a direct Microsoft advisory. The reporting does not establish a definitive patch status or guarantee that a particular mitigation will work in every environment.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If update failures persist alongside anomalous disk allocation or handle activity, investigate the combined signals and consult current Microsoft guidance for product-specific response steps. The available reporting does not provide a complete remediation procedure.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
