BigDiskBuster: Public PoC Claims to Block Microsoft Defender Platform and Security Intelligence Updates

1. Basic Information

• Original Title: New Windows Defender zero-day blocks Microsoft antivirus updates
• Source: BleepingComputer
• Published Date: 2026-09-22
• Collection Date: 2026-09-23T08:14:06+09:00
• Original Source: BleepingComputer
• Severity: high
• Severity Justification: The public PoC is designed to interfere with Microsoft Defender Antivirus platform and security intelligence updates while running locally. Although the researcher claims that it affects all supported Windows versions, Microsoft has not publicly confirmed the issue as a vulnerability, assigned a CVE, or released a specific patch. Independent reproduction and real-world exploitation have not been reported. The attack also requires prior code execution on the endpoint.
• Related Source: GitHub: MSNightmare/BigDiskBuster
• Related Source: SecurityWeek: Nightmare Eclipse Drops New Microsoft Defender Exploit
• Related Malware: None (Public PoC)
• Related Threat Group: None
• CVE: None
• Target Products/Services: Microsoft Defender Antivirus, Microsoft Windows

2. Executive Summary

BigDiskBuster is a public PoC designed to detect Microsoft Defender update activity and interfere with updates by temporarily reserving nearly all remaining free space on the C drive using hidden, delete-on-close files. It also keeps MRT.exe open with restrictive sharing permissions.

The researcher claims that this behavior can block Defender platform and security intelligence updates across all supported Windows versions. However, Microsoft confirmation, independent reproduction, and real-world exploitation have not been reported.

3. Attack Flow

The following sequence is based on the public repository code and the researcher's description. It does not represent an attack observed in a real environment.

Defender Update Disruption on Endpoints

1. An attacker obtains code execution on a Windows endpoint through another method and launches BigDiskBuster.
2. When started, the PoC opens C:\Windows\System32\MRT.exe with restrictive sharing permissions and monitors the Defender platform and security intelligence update directories.
3. When it detects update-related directory activity, the PoC creates hidden, GUID-named temporary files under %TEMP%.
4. These files use delete-on-close behavior and request allocation based on the remaining free space on the C drive, temporarily exhausting or reserving that space.
5. When the monitored update directory is removed—an event that the PoC interprets as an update failure—the process closes the temporary file handles, causing the files to be deleted and the reserved space to be released.
6. While the PoC remains running, it continues monitoring for subsequent update attempts and can repeat the disruption.
7. If update failures persist, the Defender platform or security intelligence may become outdated, potentially reducing protection against newly detected threats.

4. Attacker Position and Execution Location

• The attacker must already be able to execute code on the target Windows endpoint, whether through an earlier compromise, malicious software delivery, or user execution.
• The required privilege level has not been conclusively documented in public reporting and should be verified through independent testing.
• The disruption runs as a local process on the target endpoint. It is not described as a remotely exploitable vulnerability that can directly stop Defender updates over the network.

5. Victim and Administrator Perspectives

Victim

• A clear warning may not immediately appear, making it difficult to notice that Defender platform or security intelligence updates have stopped.
• Temporary depletion of C drive free space may cause low-disk-space warnings or instability in other applications, although such effects have not been independently documented for this PoC.

Administrator

• Indicators may include repeated Defender update failures, outdated platform or security intelligence versions, sudden drops and recoveries in C drive free space around update attempts, unusual handles to MRT.exe, and unknown long-running processes.
• Hidden, GUID-named files appearing under %TEMP% during Defender updates may provide additional evidence.

6. Success and Failure Conditions

Success Conditions

• The attacker successfully launches the PoC or equivalent code on the target endpoint.
• The process is permitted to monitor the relevant Defender update directories, open MRT.exe, and create large temporary files.
• A Defender platform or security intelligence update begins while the PoC is active.
• The resulting resource exhaustion or file-sharing conflict causes the update to fail.
• The process remains active long enough to interfere with repeated update attempts.

Failure and Prevention Conditions

• Prevent unauthorized binary execution through application control solutions such as Windows Defender Application Control (WDAC) or AppLocker.
• Detect and terminate suspicious processes that monitor Defender update paths, hold unusual handles to MRT.exe, or create large delete-on-close files.
• After terminating the process, confirm that the reserved disk space has been released and manually re-run Defender platform and security intelligence updates.
• Centrally monitor Defender versions and the time since each endpoint's last successful update to distinguish sustained interference from isolated network or service failures.

7. Outcomes upon Success

• According to the researcher's claim, Defender platform or security intelligence updates fail while the PoC remains active.
• Prolonged update failures could leave protection increasingly outdated and may make it easier for subsequent malware to evade newly released detections.
• Temporary exhaustion of the C drive could also affect other applications or operating system functions, although this broader impact has not been independently demonstrated.
• BigDiskBuster itself has not been publicly shown to execute additional malware, steal credentials, exfiltrate data, or disable the Defender scanning engine.
• Real-world exploitation and reliable reproduction across all supported Windows versions have not been confirmed.

8. Observable Logs

• email: No email-based distribution vector specific to this PoC has been reported.
• proxy_swg_dns: Successful or failed communication with Microsoft update destinations cannot, by itself, determine whether local update processing was disrupted.
• endpoint_edr: Look for processes monitoring Defender update directories, unusual handles to MRT.exe, hidden GUID-named files under %TEMP%, rapid depletion and recovery of C drive free space, and Defender update failures occurring at the same time.
• identity_idp: There is no authentication path specific to this PoC. If a preceding compromise is suspected, separately review user and administrator sessions on the affected endpoint.
• saas_cloud: In Microsoft Defender for Endpoint, review platform and security intelligence versions, last successful update times, update failures, device timelines, and sensor health.
• network: Network communication with update services may succeed even when local update processing fails. Correlate network telemetry with endpoint update results and disk activity.

9. Attack Success Determination

Confirmed in Public Information

• Public Code Available; Claimed Impact Not Independently Confirmed: Source code has been published on GitHub and implements Defender update-directory monitoring, restrictive access to MRT.exe, and temporary C drive space exhaustion. However, Microsoft has not publicly confirmed the issue as a vulnerability, and independent reproduction or real-world exploitation has not been reported.

Evaluation Criteria for Your Organization

• Confirm Initial Execution: Verify that BigDiskBuster or an equivalent unknown process was executed and subsequently monitored Defender update directories, opened MRT.exe, or created large temporary files.
• Confirm Successful Defense Disruption: Correlate the process activity with Defender update failures and a sudden reduction in C drive free space. Confirm whether disk space and update functionality recover after the process is terminated.
• Confirm Subsequent Compromise: Look for separate evidence of payload execution, persistence, credential access, privilege escalation, or outbound communication during the period in which Defender remained outdated.

10. Investigation Playbook

Trigger

• Initiate an investigation following repeated Defender update failures, outdated platform or security intelligence versions, or sudden changes in C drive free space that coincide with update attempts.

Initial Verification

• Check the current Defender platform and security intelligence versions, the last successful update time, update error codes, disk space history, and processes active during the failed updates.
• Do not rely solely on the PoC filename or published hashes. Look for the underlying behaviors involving update-directory monitoring, unusual file handles, and temporary disk-space consumption.

Endpoint

• Preserve the process tree, executable files, command lines, handles to MRT.exe, %TEMP% file metadata, Microsoft Defender Operational logs, update logs, and disk-space telemetry.
• Determine whether the suspicious process was configured for automatic startup or persistence.

Authentication and Cloud

• To identify how the PoC was executed, review endpoint logons, administrator privilege use, software distribution activity, remote management history, and the Microsoft Defender for Endpoint device timeline.

Subsequent Operations

• Investigate unknown binaries, scripts, persistence mechanisms, credential access, and outbound communications during the update outage.
• Determine whether additional malware was executed after Defender became outdated.

Containment

• Isolate the affected endpoint and preserve the suspicious process and executable for analysis before terminating them.
• After termination, confirm that the delete-on-close files and reserved disk space have been released.
• Update the Defender platform and security intelligence through trusted channels and verify successful completion.
• If additional compromise is suspected, rebuild the endpoint from a trusted image and revoke credentials that may have been accessible.

Decision Categories

• Evaluate PoC acquisition, endpoint execution, update interference, persistent protection degradation, and subsequent malware activity separately.

11. Defense and Detection Ideas

Single Event

• Detect sudden depletion of C drive free space occurring at the same time as a Defender update attempt.
• Detect unusual processes opening MRT.exe with restrictive sharing permissions or creating large hidden delete-on-close files under %TEMP%.

Timeline Correlation

• Correlate unknown process execution, Defender update-directory activity, sudden disk-space depletion, update failures, and subsequent disk-space recovery within the same short timeframe.

Hunting Perspective

• Identify endpoints where the time since the last successful Defender platform or security intelligence update exceeds the defined threshold.
• On those endpoints, check for repeated update failures, hidden temporary files, unusual handles to MRT.exe, and unknown long-running processes.

Log Gaps

• Network communication with Microsoft update destinations alone cannot identify the cause of a local update failure. Defender Operational logs, process telemetry, file activity, handle information, and disk-space history are required.

Priority Countermeasures

• Restrict unauthorized code execution using WDAC or AppLocker.
• Centrally monitor Defender platform versions, security intelligence versions, last successful update times, and recurring update errors.
• Alert when update failures coincide with rapid changes in system-drive free space or suspicious process activity.

12. Facts / Inference / Hypothesis

Facts

• The public repository contains code that monitors Microsoft Defender platform and security intelligence update directories.
• The code opens MRT.exe with restrictive sharing permissions and keeps the handle open while the process runs.
• When update-related directory activity is detected, the code creates hidden, GUID-named, delete-on-close files under %TEMP% and requests allocation based on the remaining free space on the C drive.
• The code closes the temporary file handles and releases the reserved space after detecting removal of the monitored update directory.
• The researcher claims that the PoC can disrupt Defender updates across all supported Windows versions and states that the code is buggy and requires rewriting.
• Microsoft has not publicly confirmed the issue as a vulnerability, assigned a CVE, or released a specific patch. Independent reproduction and real-world exploitation have not been reported.

Inference

• Correlating Defender update failures with process, file-handle, and disk-space telemetry is more likely to identify this behavior than monitoring update network connectivity alone.
• Temporarily exhausting the system drive may interfere with processes other than Defender, although such broader impact has not been confirmed for this PoC.

Hypothesis

• Attackers could repurpose the technique as a post-compromise defense-impairment module before deploying additional malware, but such activity has not been observed publicly.

13. MITRE ATT&CK Mapping

• T1562.001 Impair Defenses: Disable or Modify Tools (Confidence: medium) — Maps to the PoC's claimed ability to prevent Defender platform and security intelligence updates, causing the protection state to become outdated. This mapping reflects the implemented and claimed capability, not independently verified or real-world exploitation.

14. Unknowns and Further Investigation

• Reproducibility, required privileges, and success rates across different Windows and Defender versions.
• The relative contribution of the restrictive MRT.exe handle and disk-space exhaustion to the claimed update failures.
• Whether Microsoft will recognize the behavior as a security vulnerability or introduce additional protections.
• Whether the public PoC or derivative code has been used in real-world environments.
• The extent to which Tamper Protection, WDAC, AppLocker, endpoint protection policies, or storage controls prevent the behavior.
• Whether terminating the PoC and releasing its file handles consistently allows Defender updates to recover without additional remediation.

15. Impact on SOCs and Organizations

Deploying Microsoft Defender does not guarantee that platform and security intelligence updates continue successfully. Organizations should centrally monitor Defender versions, last successful update times, recurring errors, and protection health across endpoints, then correlate anomalies with process, file-handle, and disk-space activity.

Until Microsoft publishes an official assessment, organizations should prioritize preventing unauthorized code execution through WDAC or AppLocker and monitoring update health rather than relying solely on PoC-specific filenames or hashes.

16. Summary by Target Audience

• For SOCs: Correlate unknown processes, Defender update-directory activity, unusual handles to MRT.exe, sudden depletion of C drive free space, update failures, and subsequent disk-space recovery within the same timeline.
• For Administrators: Monitor Defender platform and security intelligence versions, the time since the last successful update, and recurring update errors. Restrict unauthorized code execution using WDAC or AppLocker.
• For Users: If Defender update errors, low-disk-space warnings, or protection-status warnings persist, contact your administrator rather than deleting files or disabling security controls yourself.