Skip to navigation

Threat reportVulnerabilityTL-2026-2618

BigDiskBuster PoC Blocks Microsoft Defender Antivirus Updates via Disk-Space Exhaustion

mediumACTIVE

Former Microsoft Security Response Center researcher Abdelhamid Naceri (NightmareEclipse / Chaotic Eclipse / MSNightmare) publicly released BigDiskBuster, a C++ proof-of-concept that watches Microsoft Defender Antivirus's update staging paths and fills all remaining free disk space with hidden delete-on-close files the moment a platform or security-intelligence update begins, forcing the update to fail and leaving Defender on stale threat definitions.

Key facts for BigDiskBuster Defender DoS

IdentifiersTL-2026-2618
Also known asBigDiskBuster PoC
SeverityMEDIUM
First disclosed
Exploitation statusPublic proof-of-concept exploit
Affected productsMicrosoft Microsoft Defender Antivirus (Antimalware Platform / Security Intelligence updates)
Weaknesses (CWE)CWE-400
AttributionNightmareEclipse (high confidence)
ToolsBigDiskBuster, BlueHammer, FalconFlank, GreenSection, HardBreacher, PrettyPrague, RedSun, UnDefend
MITRE ATT&CK techniquesT1070.004 File Deletion, T1082 System Information Discovery, T1204.002 Malicious File, T1499 Endpoint Denial of Service, T1518.001 Security Software Discovery, T1564.001 Hidden Files and Directories, T1587.001 Malware, T1608.001 Upload Malware, T1685 Disable or Modify Tools
MotivationHACKTIVISM
Target sectorscross-sector
Target regionsglobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for BigDiskBuster Defender DoS

As of 2026-10-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2618 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Repeated Defender Update Failures Correlated with Free-Disk-Space Collapse and Hidden Temp Files

Detects the core BigDiskBuster impairment loop: Windows Defender platform/signature update failures (Windows Defender Operational log, error 0x80070643) recurring 3+ times within an hour on a host, correlated with a sharp collapse and recovery in free disk space and hidden delete-on-close file creation under the user's %TEMP% directory — the disk-space-exhaustion-triggered-by-security-update-failure pattern the research explicitly calls out as a durable, tool-agnostic detection signature.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1562.001, T1564.001, T1070.004, T1499
  • Data sources: windows_defender_operational_log, perfmon, sysmon
  • Severity: high
  • Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational" (EventCode=2001 OR EventCode=2003)
| bucket _time span=1h
| stats count as failure_count by ComputerName, _time
| where failure_count >= 3
| join type=left ComputerName
    [ search index=perfmon sourcetype="Perfmon:LogicalDisk" counter="% Free Space" instance="C:"
      | bucket _time span=1h
      | stats min(Value) as min_free_pct max(Value) as max_free_pct by ComputerName, _time ]
| join type=left ComputerName
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*\\AppData\\Local\\Temp\\*"
      | stats count as hidden_temp_file_events by ComputerName ]
| where (max_free_pct - min_free_pct) > 40 OR hidden_temp_file_events > 5
| table ComputerName, _time, failure_count, min_free_pct, max_free_pct, hidden_temp_file_events

Microsoft KQL

let DefenderFailures = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType has_any ("AntivirusScanFailed", "AntivirusDefinitionUpdateFailed") or AdditionalFields has "0x80070643"
| summarize FailureCount = count() by DeviceName, bin(Timestamp, 1h);
let HiddenTempFiles = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"\AppData\Local\Temp\" and ActionType in ("FileCreated","FileDeleted")
| summarize TempEventCount = count(), Actions = make_set(ActionType) by DeviceName, bin(Timestamp, 1h);
DefenderFailures
| join kind=inner (HiddenTempFiles) on DeviceName
| where FailureCount >= 3 and TempEventCount >= 5
| project DeviceName, Timestamp, FailureCount, TempEventCount, Actions

Sigma

title: Recurring Windows Defender Update Failures with Free-Disk-Space Collapse
id: b4a1d2e3-5f6c-4b8d-a012-2c3d4e5f6071
status: experimental
description: Detects the disk-exhaustion-triggered-by-security-update-failure pattern used by BigDiskBuster and UnDefend to keep Microsoft Defender Antivirus on stale threat definitions — three or more Defender platform/signature update failures within an hour, indicating hidden delete-on-close temp files exhausting free disk space.
references:
    - https://github.com/MSNightmare/BigDiskBuster
    - https://www.theregister.com/security/2026/09/22/nightmareeclipses-latest-zero-day-leaves-microsoft-defender-stuck-in-the-past/5298320
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1564.001
    - attack.t1070.004
    - attack.impact
    - attack.t1499
    - attack.tool.bigdiskbuster
logsource:
    product: windows
    service: windefend
detection:
    selection:
        EventID:
            - 2001
            - 2003
    timeframe: 1h
    condition: selection | count() by ComputerName > 2
falsepositives:
    - Genuine WSUS/proxy/network outages causing legitimate repeated update failures unrelated to disk exhaustion
    - Disk space legitimately near-full due to unrelated workloads (large log rotation, backup staging) coinciding with an update window
level: high

Known false positives:

  • Genuine WSUS/proxy/network connectivity issues causing repeated but unrelated update failures
  • Disk space legitimately near-full from unrelated large file operations (backups, log rotation) coinciding with an update attempt
  • A single generic 0x80070643 event can stem from unrelated installer faults per vendor/researcher guidance — always corroborate with the free-space and temp-file signals before alerting

Tuning notes: Validate the exact Windows Defender Operational log Event IDs for update failure in your fleet's Defender build (2001/2003 used here per common conventions) and adjust; also add a check for the absence of Event ID 2000 (successful signature update) over an expected update interval, as research notes this gap is a corroborating indicator. Raise the failure_count / free-space-delta thresholds if baseline update retries are noisy in your environment.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • BigDiskBuster-Style PoC Execution & Defender Update-Staging Path Monitoring · unlock with TL Creds
  • Repeated Defender Update Failures Correlated with Free-Disk-Space Collapse and Hidden Temp Files · unlock with TL Creds
  • [indicator] Handle Tampering Correlated with BigDiskBuster PoC Download & Fleet-Wide Recurrence · unlock with TL Creds
  • BigDiskBuster-Style PoC Execution Targeting Defender Update Staging · unlock with TL Creds
  • Recurring Windows Defender Update Failures with Free-Disk-Space Collapse · unlock with TL Creds
  • Restrictive-Sharing Handle Opened on [indicator] Blocking Windows Update Replacement · unlock with TL Creds
  • BigDiskBuster-Style PoC Execution & Defender Update-Staging Path Monitoring · unlock with TL Creds
  • [indicator] Handle Tampering Correlated with BigDiskBuster PoC Download & Fleet-Wide Recurrence · unlock with TL Creds

Indicators of compromise for BigDiskBuster Defender DoS

As of 2026-10-06, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2618.

19 indicators of compromise · unlock with TL Creds. Compare plans

How BigDiskBuster Defender DoS works

No CVE has been assigned and no Microsoft advisory exists as of publication.

BigDiskBuster is a Windows Defender Antivirus denial-of-service proof-of-concept published to GitHub (github.com/MSNightmare/BigDiskBuster, MIT-licensed, implemented in a single C++ source file 'BigDiskBuster.cpp', 3 commits, 168 stars, 27 forks, 1 open issue) on or around September 19, 2026 by Abdelhamid Naceri, a former Microsoft Security Response Center researcher who worked for Microsoft's UK and Germany operations before being terminated in 2024. Naceri says the dismissal came 'abruptly and without providing a clear justification'; he rejected multiple financial settlement offers and challenged the termination in German labor court, alleging Microsoft presented 'shifting arguments throughout the proceedings.' The court upheld the termination, leaving him with minimal compensation after a costly legal battle he says damaged his mental health severely enough to require psychiatric hospital treatment. He publicly revealed his real identity around September 12, 2026, roughly a week before releasing BigDiskBuster, and in the same disclosure admitted fabricating earlier claims that Microsoft had sued him.

The tool's author describes it as 'similar to UnDefend' (his own earlier Defender DoS PoC, patched by Microsoft as CVE-2026-45498 in the out-of-band Antimalware Platform 4.18.26040.7 update on May 21, 2026, alongside the related CVE-2026-41091 — a separate local-privilege-escalation flaw in the Microsoft Malware Protection Engine caused by improperly resolving links before accessing files, fixed in engine version 1.1.26040.8. Both CVEs were confirmed exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, with a federal civilian-agency remediation deadline of June 3, 2026, alongside Naceri's earlier BlueHammer (CVE-2026-33825, CVSS 7.8) and RedSun.

BigDiskBuster monitors the C:\ volume for new directories appearing under Defender's platform- and definition-update staging paths. The instant an update begins, it checks available disk capacity and creates a hidden, delete-on-close temporary file in the user's Temp directory sized to consume all remaining free space; if capacity is freed mid-update, additional worker threads race to reclaim it, repeatedly starving the installer until it fails with the generic Windows Security installation error 0x80070643 (the researcher and reporting both note this error code has multiple unrelated possible causes and should be corroborated with other telemetry before being attributed to the tool). Once Defender tears down its staging directory following the failed attempt, BigDiskBuster deletes its own hidden file to free the disk again and waits for the next update attempt, repeating indefinitely. Independently of the disk-exhaustion loop, the tool also opens a handle on MRT.exe (the Windows Malicious Software Removal Tool) with restrictive sharing permissions, denying other processes write or delete access while the handle is held open, which blocks Windows Update from replacing that binary. The author characterizes the current release as 'a bit buggy and needs some rewritting' and claims — without independent verification — that it works on all currently supported Windows versions. As of publication there is no confirmed in-the-wild deployment of BigDiskBuster itself and no independent researcher has confirmed the claimed behavior, though the researcher's prior Defender tools (BlueHammer, RedSun, UnDefend) were each confirmed exploited by other threat actors after release, establishing a pattern in which his uncoordinated PoCs are weaponized within weeks.

Naceri's broader 2026 release cadence — nearly a dozen uncoordinated zero-days since April — extends beyond Microsoft: reporting also attributes to him GreenSection (an Nvidia driver memory-corruption flaw), HardBreacher (a Kaspersky Endpoint Security privilege-escalation flaw), PrettyPrague (an Avast Antivirus privilege-escalation flaw), and FalconFlank (a CrowdStrike Falcon privilege-escalation flaw), indicating the pattern of vendor-uncoordinated security-product disclosures is not limited to Microsoft. His earlier BlueHammer and RedSun tools both abused Windows Defender's privileged remediation/cloud-rollback file operations via opportunistic locks (oplocks) combined with NTFS junctions redirecting a temp-directory target path to C:\Windows\System32, letting an attacker overwrite a system binary with SYSTEM privileges via a time-of-check-to-time-of-use race condition — a materially different, code-execution-capable class of bug from BigDiskBuster's pure denial-of-service mechanism, but from the same author and disclosure pattern.

Security reporting recommends defenders verify Defender's current platform/signature versions (Get-MpComputerStatus, checking the AMEngineVersion and AMProductVersion fields), watch for repeated Defender update failures, sustained free-space collapse, unusual hidden files under user Temp directories, persistent open handles on MRT.exe, and a gap in Windows Defender Operational log Event ID 2000 (which normally records successful signature updates), and force updates through Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe if native update paths appear to be interfered with. Recommended response steps include preserving process and file-handle telemetry, terminating suspicious processes, recovering consumed disk space, and validating whether error 0x80070643 instances correlate with a genuine attack versus an unrelated installer fault. WDAC/AppLocker can restrict execution of unrecognized binaries that would otherwise run a tool like this.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1070.004 File Deletion; T1564.001 Hidden Files and Directories

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

Execution

T1204.002 Malicious File

Impact

T1499 Endpoint Denial of Service

Resource Development

T1587.001 Malware; T1608.001 Upload Malware

defense-impairment

T1685 Disable or Modify Tools

Remediation for BigDiskBuster Defender DoS

Patches

  • No CVE, patch, or Microsoft advisory exists for BigDiskBuster as of publication (2026-09-22)

Immediate actions

  • Run Get-MpComputerStatus (or check Windows Security > Virus & threat protection) to confirm the host's current Defender AMEngineVersion/AMProductVersion are not stale
  • Monitor Windows Defender Operational log (Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational) for missing/repeated-failure Event ID 2000 entries and Windows Security error 0x80070643, corroborating with other telemetry before attributing to this tool
  • Alert on sudden, sustained free-disk-space collapse on endpoints, especially correlated with a Defender update attempt
  • Hunt for unusual hidden, delete-on-close files being created and removed in user %TEMP% directories in a repeating pattern
  • Check for unexpected long-lived open file handles on MRT.exe (Malicious Software Removal Tool)
  • Force a trusted Defender update via Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe -SignatureUpdate if native updates appear blocked
  • If exploitation is suspected, preserve process and file-handle telemetry, terminate the suspicious process, and recover consumed disk space before re-attempting the update

Workarounds

  • Enforce minimum-free-disk-space alerting/quotas on endpoints so update installers are less likely to be starved
  • Restrict local execution of unsigned/unknown binaries on endpoints where Defender is the primary AV control

Longer-term hardening

  • Deploy WDAC or AppLocker policies restricting execution of unrecognized/unsigned binaries so a locally-run PoC like BigDiskBuster cannot be launched by a standard user
  • Add disk-space-exhaustion-triggered-by-security-update-failure as a monitored EDR/SIEM detection pattern independent of any single tool signature
  • Track this researcher's release cadence (nearly a dozen uncoordinated PoCs against Microsoft Defender, Nvidia, Kaspersky, Avast, and CrowdStrike products since April 2026) as a recurring intake source for the vulnerability-management program
  • Cross-check CISA's Known Exploited Vulnerabilities catalog for this author's prior CVEs (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498) and confirm the June 3, 2026 remediation deadline was met

Affected and fixed versions

  • Microsoft — Microsoft Defender Antivirus (Antimalware Platform / Security Intelligence updates)
    Vulnerable versions: all currently supported Windows versions (per researcher's unverified claim)

Timeline of BigDiskBuster Defender DoS

Last updated · revalidated 1× · latest source

  • locked-ioc-6 says locked-ioc-15 terminated his employment from its UK/Germany security operations abruptly and without clear justification; he rejected multiple settlement offers and later disputed the dismissal unsuccessfully in German labor court.
  • locked-ioc-18, a Defender cloud-file-rollback abuse technique (Windows Cloud Files API + junction + oplock) for SYSTEM-level privilege escalation, is disclosed in the same April 2026 window.
  • Naceri (as locked-ioc-8) publicly discloses locked-ioc-14, a Defender local-privilege-escalation zero-day (TOCTOU race condition via opportunistic lock + NTFS junction) with working PoC, later assigned CVE-2026-33825 (CVSS 7.8) and patched in the April 2026 Patch Tuesday.
  • Huntress observes locked-ioc-14, the first of Naceri's Defender zero-days, weaponized in the wild.
  • Huntress observes locked-ioc-18 and locked-ioc-16 PoCs used in intrusions; locked-ioc-16 also blocks Defender definition updates.
  • locked-ioc-15 ships out-of-band patches (Antimalware Platform 4.18.26040.7, Malware Protection Engine 1.1.26040.8) for CVE-2026-45498 (Naceri's locked-ioc-16, the direct predecessor of locked-ioc-9) and the related link-resolution local-privilege-escalation flaw CVE-2026-41091, after confirming both were being actively exploited.
  • Naceri releases RoguePlanet, another uncoordinated Windows Defender-related PoC.
  • CISA's Known Exploited Vulnerabilities catalog entries for CVE-2026-41091 and CVE-2026-45498 (added after confirmed in-the-wild exploitation, alongside Naceri's locked-ioc-14/CVE-2026-33825 and locked-ioc-18) set a federal civilian agency remediation deadline of June 3, 2026.
  • Naceri releases LegacyHive, continuing the pattern of monthly uncoordinated Defender/Windows component disclosures.
  • Naceri releases ShieldBreak.
  • Naceri publicly reveals his real identity approximately one week before releasing locked-ioc-9, detailing his disputed locked-ioc-15 termination and admitting he had fabricated earlier claims that locked-ioc-15 sued him.
  • locked-ioc-9 is published to GitHub (github.com/MSNightmare/locked-ioc-9) as a single C++ source file, described by its author as similar to locked-ioc-16 and 'a bit buggy and needs some rewritting.'
  • Naceri also releases ShieldCrash, a further Defender-targeting tool, in the same period as locked-ioc-9.
  • The Register, The Hacker News, SecurityWeek, Security Affairs, Cyber Security News, and other outlets report on locked-ioc-9; no CVE or locked-ioc-15 advisory exists at time of coverage.

Update history

Sources cited for BigDiskBuster Defender DoS

More from Nightmare Eclipse

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats