Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.
'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
About this summary. This is a short excerpt from the description that Dark Reading published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.darkreading.com/application-security/bigdiskbuster-microsoft-defender-running-blocking-updates
Source attribution: headline and facts are from Dark Reading (darkreading.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
Table Of ContentsTable of ContentsDefenderKiller Exploits a Legacy Microsoft DriverImplications for Endpoint SecurityIndicators of Compromise and Technical ArtifactsStay…
Threat actors use agentic AI tooling to find and abuse exposed secrets
From exposed secrets to cloud compromise Follow-on actions Mitigating application credential abuse activity Defending against agentic AI attacks Microsoft detections…
New investments to reduce on-premises security risk
On-premises servers can be essential to business operations, but they are increasingly attractive targets to attackers. AI can help less-skilled actors analyze software…
When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents
arXiv:2611.05806v1 Announce Type: new Abstract: Office documents are now routinely uploaded to large language models (LLMs) for processing. However, an LLM does not…
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11…
ZDI-26-868: Microsoft Windows Aero Theme Improper Handling Of Error Condition Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the…