# BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS)

> Security researcher Chaotic Eclipse (Abdelhamid Naceri, publicly identified as former Microsoft staff) released BigDiskBuster, a local proof-of-concept that starves Windows Defender's update pipeline by flooding the system drive with hidden delete-on-close temp files and holding a restrictive-sharing handle open on MRT.exe, blocking signature/platform/engine updates while the AV service keeps running. No CVE has been assigned; the author calls the code buggy and 'similar to UnDefend', his earlier April 2026 Defender-update-blocking PoC, and part of a wider string of zero-day releases (RoguePlanet, ShieldCrash, RedSun, GreenSection, HardBreacher, PrettyPrague, FalconFlank) he attributes to a labor dispute with Microsoft.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2613
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-bigdiskbuster-defender-update-dos-tl-2026-2613.webp?v=e198ad03 (Threadlinqs threat intel: BigDiskBuster Windows Defender DoS: Detection & IOCs (TL-2026-2613) — Medium severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-2613
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Chaotic Eclipse
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

BigDiskBuster (published 2026-09-21 at github.com/MSNightmare/BigDiskBuster, MIT license, 3 commits, 165 stars/26 forks at time of review) is a Windows Defender Update Denial-of-Service proof-of-concept authored by the researcher publicly identified as Abdelhamid Naceri, operating under the handles Chaotic Eclipse, Nightmare Eclipse, MSNightmare, and INFINITE NIGHTMARE. The tool's README describes it as 'similar to UnDefend' (Naceri's April 2026 Defender PoC that let a standard user block definition updates) and states it 'prevents windows defender from performing platform/signature updates.'

Exploit chain / mechanics, per the released C++ source (BigDiskBuster.cpp): the tool registers a change-notification watch (ReadDirectoryChangesW, with FILE_NOTIFY_CHANGE_FILE_NAME / FILE_NOTIFY_CHANGE_DIR_NAME / FILE_NOTIFY_CHANGE_SIZE flags, processed asynchronously via GetOverlappedResult) on Windows Defender's Platform and Definition Updates directories under C:\ProgramData\Microsoft\Windows Defender\ -- i.e. it fingerprints Defender's own update behavior (a security-software-discovery step) to know when to strike, rather than running continuously at full intensity. When update activity is observed, it queries available free capacity on the system volume via the low-level native API NtQueryVolumeInformationFile (a system/disk-information-discovery step, called directly rather than through the higher-level Win32 GetDiskFreeSpaceEx wrapper) and then spawns worker threads (CreateThread / WaitForSingleObject) that open files via NtCreateFile in the user's %TEMP% directory with FILE_ATTRIBUTE_HIDDEN set and the FILE_DELETE_ON_CLOSE creation flag (reinforced with SetFileInformationByHandle using FILE_DISPOSITION_FLAG_DELETE / FILE_DISPOSITION_FLAG_POSIX_SEMANTICS), sized to consume the remaining free space; file/folder names for these temp objects are generated with CoCreateGuid / StringFromGUID2 / CLSIDFromString, producing GUID-formatted names that resemble legitimate Windows-generated temporary artifacts rather than an obviously attacker-authored filename. If the update process frees space by unpacking/removing files, the worker threads immediately reclaim the newly freed capacity via the same mechanism, starving the update of the disk headroom it needs. Because the temp files carry the delete-on-close disposition, they are automatically removed by the OS the moment their handles are closed, leaving little forensic trace once the tool exits or releases them -- the PoC releases its handles and frees the consumed space once the monitored update directory stops showing activity (interpreted as a failed update attempt). In parallel, the tool opens a handle on the Malicious Software Removal Tool binary (C:\Windows\System32\MRT.exe) with a restrictive combination of sharing flags (omitting FILE_SHARE_WRITE/FILE_SHARE_DELETE on at least one open handle), blocking other processes -- including the updater -- from replacing or modifying that file. Together these primitives cause Defender's three update streams -- security intelligence (malware signatures), engine updates, and platform updates -- to fail, while the Defender/AV service itself continues to report as running, masking the degraded protection state from casual observation. The author's own description of the tool: 'Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background' -- confirming the DoS requires the process to remain resident; no autostart/persistence mechanism is described. Observed failure indicators reported by independent analysis include Windows error code 0x80070643 ('Protection definition update failed') and the absence of the normally-recorded Event ID 2000 (successful signature update) under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

The author states the PoC 'seems to work on all supported windows versions but ... is a bit buggy and needs some rewritting.' No independent verification of cross-version compatibility was found in available reporting, and no CVE identifier or Microsoft security advisory has been issued as of 2026-09-22. Exploitation requires local code execution (an adversary or insider already has access to run an arbitrary binary on the target); it is not a remote or network-facing vector, and no privilege escalation is required beyond running the binary in a session with write access to %TEMP%. One risk-scoring aggregator (Rankiteo) independently rated the disclosure 85/100 severity with an impact rating of 4; this is a third-party heuristic score, not a CVSS vector, and this record's own severity_level is set independently per the absence of a vendor CVSS score.

Attribution / context: BigDiskBuster is the latest in a string of roughly a dozen zero-day/PoC releases Naceri has published since roughly April 2026, spanning Microsoft Defender and BitLocker (UnDefend, BigDiskBuster, RoguePlanet, ShieldCrash, RedSun, LegacyHive, BlueHammer, YellowKey, GreenPlasma, MiniPlasma), Nvidia (GreenSection, memory corruption), Kaspersky Endpoint Security (HardBreacher, privilege escalation), Avast/GenDigital Antivirus (PrettyPrague, privilege escalation), and CrowdStrike Falcon (FalconFlank, a privilege-escalation PoC reported to abuse Falcon's own macro-removal feature). Of particular note is RoguePlanet (CVE-2026-50656), released 2026-06-10 -- hours after that month's Patch Tuesday -- a separate local-privilege-escalation PoC that abuses a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Microsoft Defender's file-processing path (MsMpEng.exe validates a file path, then the attacker swaps the target via an NTFS reparse point/junction/symbolic-link redirection before the write completes) to obtain SYSTEM-level code execution on fully patched Windows 10/11; the researcher reported inconsistent reliability ('100% success rate on some machines while it struggled to work on others'). Microsoft patched RoguePlanet on 2026-07-09 via an out-of-band Malware Protection Engine update (version 1.1.26060.3008) rather than the standard Patch Tuesday cadence. RoguePlanet is a distinct vulnerability and exploit chain from BigDiskBuster (privilege escalation via race condition vs. local resource-exhaustion DoS) and its MITRE ATT&CK mapping is NOT carried into this record's technique list, which is scoped to BigDiskBuster's own observed mechanism. Two weeks before BigDiskBuster, on 2026-09-09, Naceri also released ShieldCrash, a PoC that triggers an arbitrary SYSTEM-level file read in the Malware Protection Engine by exploiting a gap in Microsoft's September 2026 patch (engine version 1.1.26080.3) for CVE-2026-69414 (ShieldBreak) -- again a distinct vulnerability/PoC from BigDiskBuster, part of the same disclosure campaign against Microsoft security products. Naceri publicly disclosed his identity roughly one week before releasing BigDiskBuster (2026-09-14), stating he previously worked for Microsoft in the UK and Germany, was terminated in March 2025 'abruptly and without a clear justification,' was offered and rejected multiple financial settlement options, sought a formal explanation and help remaining in Germany, and ultimately lost a German labor-court challenge to the dismissal after a lengthy process that he says severely damaged his mental health (he has stated he received treatment in a psychiatric hospital). In that same disclosure he also acknowledged that earlier public claims he had made -- that Microsoft had taken legal action against him -- were fabricated, a credibility caveat this record notes without independently verifying any of his self-reported biographical claims. He has framed the release cadence as tied to the employment dispute; Microsoft, contacted by reporters, did not immediately comment on BigDiskBuster.

Defensive impact: because this is a local resource-exhaustion and file-locking technique rather than a memory-safety bug, no memory corruption or code execution primitive is granted -- the impact is purely availability-focused, degrading a Defender endpoint's ability to receive current threat intelligence and thereby creating a detection/response blind spot for any subsequent, unrelated attack on the same host. Recommended detection/mitigation centers on monitoring free-disk-space collapses on the system volume, hidden large temp-file creation (including GUID-formatted hidden files/directories in %TEMP%), anomalous long-lived restrictive handles on MRT.exe, and absence of expected Defender Operational log Event ID 2000 / presence of error 0x80070643, combined with forcing updates via managed channels (Windows Update, WSUS, Windows Security app, or MpCmdRun.exe) and application-control policies (WDAC/AppLocker) to limit which binaries can execute locally in the first place; incident responders are additionally advised to preserve process and file-handle telemetry before terminating the offending process and recovering disk capacity.

## MITRE ATT&CK

- T1587.004 Exploits
- T1106 Native API
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1564.001 Hidden Files and Directories
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1499.001 OS Exhaustion Flood

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BigDiskBuster – High-Frequency Hidden GUID-Named Delete-on-Close Temp File Creation (Disk-Exhaustion DoS)** (`TL-2026-2613-SPL-002`)

Detects a burst of hidden, GUID-formatted temporary files created in %TEMP% within a one-minute window — the core disk-space-exhaustion mechanism BigDiskBuster uses to starve Windows Defender's signature/platform/engine updates of free capacity. Files carry FILE_DELETE_ON_CLOSE disposition and GUID names generated via CoCreateGuid to mimic legitimate Windows-generated temp artifacts, masquerading among normal OS/application temp churn.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1564.001, T1070.004, T1036.005, T1499.001
- **Data sources:** sysmon (Event ID 11 - FileCreate), Microsoft Defender for Endpoint DeviceFileEvents, %TEMP% file-system telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon EventCode=11 TargetFilename="*\AppData\Local\Temp\*"
| rex field=TargetFilename "(?<fname>\{?[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}?)$"
| where isnotnull(fname)
| bucket _time span=1m
| stats count as file_creates, dc(TargetFilename) as distinct_guid_files by _time, ComputerName, Image, ProcessGuid, User
| where file_creates >= 20
| sort - file_creates
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"\AppData\Local\Temp\"
| where FileName matches regex @"^\{?[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}?$"
| summarize FileCreates=count(), DistinctNames=dcount(FileName) by bin(Timestamp, 1m), DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessAccountName
| where FileCreates >= 20
| sort by FileCreates desc
```

### Sigma

```yaml
title: High-Frequency Hidden GUID-Named Temp File Creation (Disk-Exhaustion DoS Pattern)
id: 3f9d2b6e-8c1a-4e7f-b2d4-6a0c5e9f1d33
status: experimental
description: Detects a burst of hidden, GUID-formatted delete-on-close temporary files created in %TEMP% within a short window -- the disk-space-exhaustion mechanism used by BigDiskBuster to starve Windows Defender's update pipeline of free capacity while mimicking legitimate Windows-generated temp artifacts.
references:
    - https://github.com/MSNightmare/BigDiskBuster
    - https://attack.mitre.org/techniques/T1564/001/
    - https://attack.mitre.org/techniques/T1070/004/
    - https://attack.mitre.org/techniques/T1036/005/
    - https://attack.mitre.org/techniques/T1499/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.defense-evasion
    - attack.t1564.001
    - attack.t1070.004
    - attack.t1036.005
    - attack.impact
    - attack.t1499.001
    - attack.tool.bigdiskbuster
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\AppData\Local\Temp\'
        TargetFilename|re: '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$'
    timeframe: 1m
    condition: selection | count() by Image > 20
falsepositives:
    - Windows Installer (MSI) or COM component registration workflows that legitimately generate GUID-named temp artifacts in bursts
    - Software update/patch stagers that use GUID temp naming
level: high
```

**Known false positives:**

- Windows Installer (MSI) and COM/DCOM component operations that legitimately generate GUID-named temp files in bursts
- Browser or update-agent cache-churn operations that create/delete many temp files rapidly
- Backup or sync clients (e.g., OneDrive) performing bulk temp staging during large transfers

**Tuning notes:** Tune the per-minute file-create threshold (default 20) to your endpoint baseline -- high-I/O workstations (build servers, video/media editing) may need a higher threshold or a dedicated allowlist; extend the search to flag files whose size approaches remaining free capacity where per-file size telemetry is available, and pair with LogicalDisk free-space monitoring for confirmation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BigDiskBuster – Unsigned Process Launch Preceding Defender Update-DoS (Discovery/Native API Precursor) (locked: unlock with TL Creds)
- BigDiskBuster – High-Frequency Hidden GUID-Named Delete-on-Close Temp File Creation (Disk-Exhaustion DoS) (locked: unlock with TL Creds)
- BigDiskBuster – Windows Defender Update Failure Without Recent Successful Signature Update (Sustained Denial) (locked: unlock with TL Creds)
- BigDiskBuster – Unsigned Process Launch Preceding Defender Update-DoS (Discovery/Native API Precursor) (locked: unlock with TL Creds)
- BigDiskBuster – High-Frequency Hidden GUID-Named Delete-on-Close Temp File Creation (Disk-Exhaustion DoS) (locked: unlock with TL Creds)
- BigDiskBuster – Windows Defender Update Failure Without Recent Successful Signature Update (Sustained Denial) (locked: unlock with TL Creds)
- BigDiskBuster – Unsigned Process Launch Preceding Defender Update-DoS (Discovery/Native API Precursor) (locked: unlock with TL Creds)
- BigDiskBuster – Windows Defender Update Failure Without Recent Successful Signature Update (Sustained Denial) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Chaotic Eclipse released BigDiskBuster, a PoC for Windows Defender update DoS zero-day](https://securityaffairs.com/199538/hacking/chaotic-eclipse-released-bigdiskbuster-a-poc-for-windows-defender-update-dos-zero-day.html)
- [Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day](https://securityaffairs.com/198726/security/chaotic-eclipse-released-shieldcrash-a-poc-for-microsoft-defender-zero-day.html)
- [New Windows Defender zero-day blocks Microsoft antivirus updates](https://www.bleepingcomputer.com/news/security/new-windows-defender-zero-day-blocks-microsoft-antivirus-updates/)
- [MSNightmare has Released a Windows Defender Update DoS Vulnerability Called BigDiskBuster](https://cybersecuritynews.com/defender-bigdiskbuster-dos-flaw/)
- [Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity](https://www.securityweek.com/nightmare-eclipse-drops-new-microsoft-defender-exploit-after-revealing-identity/)
- [MSNightmare/BigDiskBuster (GitHub repository)](https://github.com/MSNightmare/BigDiskBuster)
- [Microsoft: BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates](https://blog.rankiteo.com/mic1789986463-microsoft-vulnerability-september-2026/)
- [BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates](https://cyberpress.org/bigdiskbuster-windows-defender-dos-vulnerability/)
- [BigDiskBuster PoC Claims Defender Update DoS via Disk Space](https://windowsforum.com/news/bigdiskbuster-poc-claims-defender-update-dos-via-disk-space.445254/)
- [Microsoft patches RoguePlanet Defender zero-day vulnerability](https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/)
- [Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)](https://www.helpnetsecurity.com/2026/06/17/rogueplanet-zero-day-cve-2026-50656/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2613