Indicator Removal × Microsoft Defender

prevents Microsoft Defender from completing security updates by exhausting disk space

BigDiskBuster abuses Microsoft Defender's update process by creating large files that consume all available disk space, preventing Defender from downloading and applying security definition updates. It likely manipulates Defender's update staging area or uses its own update mechanism to write excessive data, causing update failures and leaving the endpoint with outdated signatures.

Monitor for abnormal disk usage patterns, especially sudden creation of large files in Defender's update directories or system temp folders. Alert on repeated Defender update failures and low disk space conditions. Implement disk quotas and monitor file creation events via Sysmon or EDR telemetry.