BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS)

Key facts for BigDiskBuster Defender update DoS

Detection coverage for BigDiskBuster Defender update DoS

As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2613 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BigDiskBuster – High-Frequency Hidden GUID-Named Delete-on-Close Temp File Creation (Disk-Exhaustion DoS)

Detects a burst of hidden, GUID-formatted temporary files created in %TEMP% within a one-minute window — the core disk-space-exhaustion mechanism BigDiskBuster uses to starve Windows Defender's signature/platform/engine updates of free capacity. Files carry FILE_DELETE_ON_CLOSE disposition and GUID names generated via CoCreateGuid to mimic legitimate Windows-generated temp artifacts, masquerading among normal OS/application temp churn.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1564.001, T1070.004, T1036.005, T1499.001
• Data sources: sysmon (Event ID 11 - FileCreate), Microsoft Defender for Endpoint DeviceFileEvents, %TEMP% file-system telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon EventCode=11 TargetFilename="*\AppData\Local\Temp\*"
| rex field=TargetFilename "(?<fname>\{?[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}?)$"
| where isnotnull(fname)
| bucket _time span=1m
| stats count as file_creates, dc(TargetFilename) as distinct_guid_files by _time, ComputerName, Image, ProcessGuid, User
| where file_creates >= 20
| sort - file_creates

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"\AppData\Local\Temp\"
| where FileName matches regex @"^\{?[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}?$"
| summarize FileCreates=count(), DistinctNames=dcount(FileName) by bin(Timestamp, 1m), DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessAccountName
| where FileCreates >= 20
| sort by FileCreates desc

Sigma

title: High-Frequency Hidden GUID-Named Temp File Creation (Disk-Exhaustion DoS Pattern)
id: 3f9d2b6e-8c1a-4e7f-b2d4-6a0c5e9f1d33
status: experimental
description: Detects a burst of hidden, GUID-formatted delete-on-close temporary files created in %TEMP% within a short window -- the disk-space-exhaustion mechanism used by BigDiskBuster to starve Windows Defender's update pipeline of free capacity while mimicking legitimate Windows-generated temp artifacts.
references:
    - https://github.com/MSNightmare/BigDiskBuster
    - https://attack.mitre.org/techniques/T1564/001/
    - https://attack.mitre.org/techniques/T1070/004/
    - https://attack.mitre.org/techniques/T1036/005/
    - https://attack.mitre.org/techniques/T1499/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.defense-evasion
    - attack.t1564.001
    - attack.t1070.004
    - attack.t1036.005
    - attack.impact
    - attack.t1499.001
    - attack.tool.bigdiskbuster
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\AppData\Local\Temp\'
        TargetFilename|re: '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$'
    timeframe: 1m
    condition: selection | count() by Image > 20
falsepositives:
    - Windows Installer (MSI) or COM component registration workflows that legitimately generate GUID-named temp artifacts in bursts
    - Software update/patch stagers that use GUID temp naming
level: high

Known false positives:

• Windows Installer (MSI) and COM/DCOM component operations that legitimately generate GUID-named temp files in bursts
• Browser or update-agent cache-churn operations that create/delete many temp files rapidly
• Backup or sync clients (e.g., OneDrive) performing bulk temp staging during large transfers

Tuning notes: Tune the per-minute file-create threshold (default 20) to your endpoint baseline -- high-I/O workstations (build servers, video/media editing) may need a higher threshold or a dedicated allowlist; extend the search to flag files whose size approaches remaining free capacity where per-file size telemetry is available, and pair with LogicalDisk free-space monitoring for confirmation.

• 🔒 BigDiskBuster – Unsigned Process Launch Preceding Defender Update-DoS (Discovery/Native API Precursor) · unlock with TL Creds
• 🔒 BigDiskBuster – High-Frequency Hidden GUID-Named Delete-on-Close Temp File Creation (Disk-Exhaustion DoS) · unlock with TL Creds
• 🔒 BigDiskBuster – Windows Defender Update Failure Without Recent Successful Signature Update (Sustained Denial) · unlock with TL Creds
• 🔒 BigDiskBuster – Unsigned Process Launch Preceding Defender Update-DoS (Discovery/Native API Precursor) · unlock with TL Creds
• 🔒 BigDiskBuster – High-Frequency Hidden GUID-Named Delete-on-Close Temp File Creation (Disk-Exhaustion DoS) · unlock with TL Creds
• 🔒 BigDiskBuster – Windows Defender Update Failure Without Recent Successful Signature Update (Sustained Denial) · unlock with TL Creds
• 🔒 BigDiskBuster – Unsigned Process Launch Preceding Defender Update-DoS (Discovery/Native API Precursor) · unlock with TL Creds
• 🔒 BigDiskBuster – Windows Defender Update Failure Without Recent Successful Signature Update (Sustained Denial) · unlock with TL Creds

Indicators of compromise for BigDiskBuster Defender update DoS

As of 2026-09-22, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2613.

How BigDiskBuster Defender update DoS works

No CVE has been assigned; the author calls the code buggy and 'similar to UnDefend', his earlier April 2026 Defender-update-blocking PoC, and part of a wider string of zero-day releases (RoguePlanet, ShieldCrash, RedSun, GreenSection, HardBreacher, PrettyPrague, FalconFlank) he attributes to a labor dispute with Microsoft.

BigDiskBuster (published 2026-09-21 at github.com/MSNightmare/BigDiskBuster, MIT license, 3 commits, 165 stars/26 forks at time of review) is a Windows Defender Update Denial-of-Service proof-of-concept authored by the researcher publicly identified as Abdelhamid Naceri, operating under the handles Chaotic Eclipse, Nightmare Eclipse, MSNightmare, and INFINITE NIGHTMARE. The tool's README describes it as 'similar to UnDefend' (Naceri's April 2026 Defender PoC that let a standard user block definition updates) and states it 'prevents windows defender from performing platform/signature updates.'

Exploit chain / mechanics, per the released C++ source (BigDiskBuster.cpp): the tool registers a change-notification watch (ReadDirectoryChangesW, with FILE_NOTIFY_CHANGE_FILE_NAME / FILE_NOTIFY_CHANGE_DIR_NAME / FILE_NOTIFY_CHANGE_SIZE flags, processed asynchronously via GetOverlappedResult) on Windows Defender's Platform and Definition Updates directories under C:\ProgramData\Microsoft\Windows Defender\ -- i.e. it fingerprints Defender's own update behavior (a security-software-discovery step) to know when to strike, rather than running continuously at full intensity. When update activity is observed, it queries available free capacity on the system volume via the low-level native API NtQueryVolumeInformationFile (a system/disk-information-discovery step, called directly rather than through the higher-level Win32 GetDiskFreeSpaceEx wrapper) and then spawns worker threads (CreateThread / WaitForSingleObject) that open files via NtCreateFile in the user's %TEMP% directory with FILE_ATTRIBUTE_HIDDEN set and the FILE_DELETE_ON_CLOSE creation flag (reinforced with SetFileInformationByHandle using FILE_DISPOSITION_FLAG_DELETE / FILE_DISPOSITION_FLAG_POSIX_SEMANTICS), sized to consume the remaining free space; file/folder names for these temp objects are generated with CoCreateGuid / StringFromGUID2 / CLSIDFromString, producing GUID-formatted names that resemble legitimate Windows-generated temporary artifacts rather than an obviously attacker-authored filename. If the update process frees space by unpacking/removing files, the worker threads immediately reclaim the newly freed capacity via the same mechanism, starving the update of the disk headroom it needs. Because the temp files carry the delete-on-close disposition, they are automatically removed by the OS the moment their handles are closed, leaving little forensic trace once the tool exits or releases them -- the PoC releases its handles and frees the consumed space once the monitored update directory stops showing activity (interpreted as a failed update attempt). In parallel, the tool opens a handle on the Malicious Software Removal Tool binary (C:\Windows\System32\MRT.exe) with a restrictive combination of sharing flags (omitting FILE_SHARE_WRITE/FILE_SHARE_DELETE on at least one open handle), blocking other processes -- including the updater -- from replacing or modifying that file. Together these primitives cause Defender's three update streams -- security intelligence (malware signatures), engine updates, and platform updates -- to fail, while the Defender/AV service itself continues to report as running, masking the degraded protection state from casual observation. The author's own description of the tool: 'Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background' -- confirming the DoS requires the process to remain resident; no autostart/persistence mechanism is described. Observed failure indicators reported by independent analysis include Windows error code 0x80070643 ('Protection definition update failed') and the absence of the normally-recorded Event ID 2000 (successful signature update) under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

The author states the PoC 'seems to work on all supported windows versions but ... is a bit buggy and needs some rewritting.' No independent verification of cross-version compatibility was found in available reporting, and no CVE identifier or Microsoft security advisory has been issued as of 2026-09-22. Exploitation requires local code execution (an adversary or insider already has access to run an arbitrary binary on the target); it is not a remote or network-facing vector, and no privilege escalation is required beyond running the binary in a session with write access to %TEMP%. One risk-scoring aggregator (Rankiteo) independently rated the disclosure 85/100 severity with an impact rating of 4; this is a third-party heuristic score, not a CVSS vector, and this record's own severity_level is set independently per the absence of a vendor CVSS score.

Attribution / context: BigDiskBuster is the latest in a string of roughly a dozen zero-day/PoC releases Naceri has published since roughly April 2026, spanning Microsoft Defender and BitLocker (UnDefend, BigDiskBuster, RoguePlanet, ShieldCrash, RedSun, LegacyHive, BlueHammer, YellowKey, GreenPlasma, MiniPlasma), Nvidia (GreenSection, memory corruption), Kaspersky Endpoint Security (HardBreacher, privilege escalation), Avast/GenDigital Antivirus (PrettyPrague, privilege escalation), and CrowdStrike Falcon (FalconFlank, a privilege-escalation PoC reported to abuse Falcon's own macro-removal feature). Of particular note is RoguePlanet (CVE-2026-50656), released 2026-06-10 -- hours after that month's Patch Tuesday -- a separate local-privilege-escalation PoC that abuses a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Microsoft Defender's file-processing path (MsMpEng.exe validates a file path, then the attacker swaps the target via an NTFS reparse point/junction/symbolic-link redirection before the write completes) to obtain SYSTEM-level code execution on fully patched Windows 10/11; the researcher reported inconsistent reliability ('100% success rate on some machines while it struggled to work on others'). Microsoft patched RoguePlanet on 2026-07-09 via an out-of-band Malware Protection Engine update (version 1.1.26060.3008) rather than the standard Patch Tuesday cadence. RoguePlanet is a distinct vulnerability and exploit chain from BigDiskBuster (privilege escalation via race condition vs. local resource-exhaustion DoS) and its MITRE ATT&CK mapping is NOT carried into this record's technique list, which is scoped to BigDiskBuster's own observed mechanism. Two weeks before BigDiskBuster, on 2026-09-09, Naceri also released ShieldCrash, a PoC that triggers an arbitrary SYSTEM-level file read in the Malware Protection Engine by exploiting a gap in Microsoft's September 2026 patch (engine version 1.1.26080.3) for CVE-2026-69414 (ShieldBreak) -- again a distinct vulnerability/PoC from BigDiskBuster, part of the same disclosure campaign against Microsoft security products. Naceri publicly disclosed his identity roughly one week before releasing BigDiskBuster (2026-09-14), stating he previously worked for Microsoft in the UK and Germany, was terminated in March 2025 'abruptly and without a clear justification,' was offered and rejected multiple financial settlement options, sought a formal explanation and help remaining in Germany, and ultimately lost a German labor-court challenge to the dismissal after a lengthy process that he says severely damaged his mental health (he has stated he received treatment in a psychiatric hospital). In that same disclosure he also acknowledged that earlier public claims he had made -- that Microsoft had taken legal action against him -- were fabricated, a credibility caveat this record notes without independently verifying any of his self-reported biographical claims. He has framed the release cadence as tied to the employment dispute; Microsoft, contacted by reporters, did not immediately comment on BigDiskBuster.

Defensive impact: because this is a local resource-exhaustion and file-locking technique rather than a memory-safety bug, no memory corruption or code execution primitive is granted -- the impact is purely availability-focused, degrading a Defender endpoint's ability to receive current threat intelligence and thereby creating a detection/response blind spot for any subsequent, unrelated attack on the same host. Recommended detection/mitigation centers on monitoring free-disk-space collapses on the system volume, hidden large temp-file creation (including GUID-formatted hidden files/directories in %TEMP%), anomalous long-lived restrictive handles on MRT.exe, and absence of expected Defender Operational log Event ID 2000 / presence of error 0x80070643, combined with forcing updates via managed channels (Windows Update, WSUS, Windows Security app, or MpCmdRun.exe) and application-control policies (WDAC/AppLocker) to limit which binaries can execute locally in the first place; incident responders are additionally advised to preserve process and file-handle telemetry before terminating the offending process and recovering disk capacity.

MITRE ATT&CK techniques by tactic:

Stealth

T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1564.001 Hidden Files and Directories

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

Execution

T1106 Native API

Impact

T1499.001 OS Exhaustion Flood

Resource Development

T1587.004 Exploits

Defense Impairment

T1685 Disable or Modify Tools

Remediation for BigDiskBuster Defender update DoS

Patches

• No vendor patch or CVE has been issued for BigDiskBuster as of 2026-09-22; Microsoft has not published a security advisory referencing this PoC

Immediate actions

• Monitor system-drive (C:) free space on Defender-managed endpoints for sudden, sustained collapses and alert on repeated low-disk-space conditions
• Alert on creation of large hidden delete-on-close temporary files (including GUID-formatted names) in user %TEMP% directories, especially correlated with Defender update activity
• Review process handles/locks on C:\Windows\System32\MRT.exe for unexpected long-lived restrictive-sharing opens by non-security processes
• Validate endpoint protection status with the Get-MpComputerStatus PowerShell cmdlet and confirm signature/engine/platform version timestamps against a known-good baseline
• Alert on absence of the expected Windows Defender Operational log Event ID 2000 (successful signature update) or presence of error code 0x80070643 ('Protection definition update failed')
• Preserve process and file-handle telemetry (owning process, handle list, temp-file paths) before terminating a suspected offending process, to support incident review

Workarounds

• Set free-disk-space alerting thresholds comfortably above the capacity Defender needs to stage/unpack signature and platform packages
• Apply least-privilege / application-allowlisting controls to reduce the pool of endpoints where an adversary or insider can execute an arbitrary local binary
• If exploitation is suspected: terminate the offending process and recover consumed disk capacity, then force a manual update via managed channels

Longer-term hardening

• Deploy application control (WDAC or AppLocker) to restrict execution of untrusted/unsigned local binaries capable of this disk-exhaustion / handle-locking technique
• Force trusted signature/platform/engine updates through managed channels (Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe -SignatureUpdate) rather than relying solely on background update checks
• Incorporate persistent Defender update-failure monitoring into SOC dashboards/alerting rather than trusting a 'service running' status alone, since the AV service remains apparently functional during the DoS

Affected and fixed versions

• Microsoft — Microsoft Defender Antivirus (Windows)
  Vulnerable versions: All currently supported Windows versions (per researcher claim; not independently verified per-version in available reporting)
  Fixed in: None -- no patch or CVE issued as of 2026-09-22

Timeline of BigDiskBuster Defender update DoS

• 2025-03-01 locked-ioc-6's employment with locked-ioc-14 (Germany) was terminated; he later said the company gave no clear justification and rejected his settlement offer counter-proposal, subsequently losing a German labor-court challenge to the dismissal.
• 2026-04-01 Naceri released locked-ioc-15, a proof-of-concept allowing a standard Windows user to block locked-ioc-14 Defender definition updates -- the direct predecessor technique that locked-ioc-7 is described as 'similar to'.
• 2026-06-10 Naceri (as Nightmare Eclipse) released locked-ioc-11, a separate local privilege-escalation PoC exploiting a TOCTOU race condition in locked-ioc-14 Defender's file-processing path (MsMpEng.exe) via NTFS reparse-point redirection to gain SYSTEM-level access on fully patched Windows 10/11, released hours after that month's Patch Tuesday.
• 2026-07-09 locked-ioc-14 patched locked-ioc-11 (CVE-2026-50656) out-of-band via a Malware Protection Engine update (version 1.1.26060.3008), rather than through the standard monthly Patch Tuesday cycle.
• 2026-09-09 Naceri released locked-ioc-12, a separate PoC exploiting an incomplete patch of CVE-2026-69414 (ShieldBreak) to trigger an arbitrary SYSTEM-level file read in locked-ioc-14 Defender, published roughly two weeks before locked-ioc-7.
• 2026-09-14 Naceri publicly revealed his real identity behind the Chaotic Eclipse / Nightmare Eclipse / MSNightmare / INFINITE NIGHTMARE personas, approximately one week before releasing locked-ioc-7.
• 2026-09-21 locked-ioc-7 published on GitHub (MSNightmare/locked-ioc-7, MIT license, 3 commits), described by its author as functional across all supported Windows versions but still buggy and needing a rewrite.
• 2026-09-22 Independent outlets (BleepingComputer, CyberSecurityNews, SecurityWeek, Cyberpress, Rankiteo, WindowsForum) corroborated the disk-exhaustion / MRT.exe handle-locking mechanism, the researcher's identity and motive, and confirmed no CVE or locked-ioc-14 advisory had been issued; locked-ioc-14 did not immediately comment when contacted.
• 2026-09-22 Security Affairs published the first tracked media coverage of locked-ioc-7, matching this threat entry's hunt source feed date.

Sources cited for BigDiskBuster Defender update DoS

• MSNightmare/BigDiskBuster (GitHub repository) GitHub · Code repository · 2026-09-21
• Microsoft: BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates blog.rankiteo.com · Blog · 2026-09-21
• BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates cyberpress.org · Blog · 2026-09-21
• BigDiskBuster PoC Claims Defender Update DoS via Disk Space windowsforum.com · Blog · 2026-09-21
• Chaotic Eclipse released BigDiskBuster, a PoC for Windows Defender update DoS zero-day securityaffairs.com · News · 2026-09-22
• Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day securityaffairs.com · News · 2026-09-09
• New Windows Defender zero-day blocks Microsoft antivirus updates BleepingComputer · News · 2026-09-22
• MSNightmare has Released a Windows Defender Update DoS Vulnerability Called BigDiskBuster cybersecuritynews.com · News · 2026-09-22
• Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity SecurityWeek · News · 2026-09-22
• Microsoft patches RoguePlanet Defender zero-day vulnerability BleepingComputer · News · 2026-07-09
• Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) Help Net Security · News · 2026-06-17

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

More from Chaotic Eclipse

• FalconFlank: Unpatched Local Privilege Escalation PoC in CrowdStrike Falcon Sensor via Office Macro Remediation
• RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched
• Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
• Windows 'MiniPlasma' Zero-Day — Unpatched SYSTEM LPE via cldflt.sys HsmOsBlockPlaceholderAccess / CfAbortHydration (CVE-2020-17103 Regression)
• YellowKey & GreenPlasma — Unpatched Windows BitLocker Bypass & CTFMON LPE Zero-Days With Public PoC (Chaotic/Nightmare Eclipse)

Previous and next in vulnerability

• Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV Previous report