Affected Systems

Microsoft Defender on all supported Windows versions. No patch available. Tool published September 19, 2026 by Abdelhamid Naceri. No CVE assigned.

Exploitation Status

Public proof-of-concept available on GitHub since September 19. Author's previous Defender exploits (BlueHammer, RedSun, UnDefend) were exploited in live attacks and added to CISA KEV. No confirmed exploitation of BigDiskBuster reported yet.

Business Impact

Prevents Defender platform and signature updates by filling disk space, causing detection content to become stale. Defender continues running but cannot detect new threats. Tool also blocks Windows Malicious Software Removal Tool (MRT.exe) updates. Author states tool is "buggy" and no independent confirmation exists. Similar technique (UnDefend, CVE-2026-45498) was patched in May 2026, but BigDiskBuster uses different mechanism and likely bypasses that fix.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Verify Defender signature and platform versions are current via Windows Security > Virus & threat protection > Protection updates or PowerShell Get-MpComputerStatus (check AMEngineVersion and AMProductVersion fields)
  • Monitor for repeated Defender update failures, sustained low disk space on system volume (C:\), and large hidden files in temporary directories under Defender update paths
  • Implement application control via Windows Defender Application Control (WDAC) or AppLocker to restrict execution of unknown binaries
  • Review logs for processes creating large temporary files or accessing MRT.exe with blocking handles
  • Escalate to Microsoft support for guidance on detection and mitigation until patch is released

---

# Threat Actor Context

Actor Profile

Abdelhamid Naceri is a former Microsoft Security Response Center researcher dismissed in 2024. Since April 2024, he has been publicly releasing uncoordinated exploits targeting Microsoft Defender and Windows. His motivation appears to be retaliatory disclosure following his dismissal. Naceri's previous Defender exploits (BlueHammer, RedSun, UnDefend) were weaponized in live intrusions before patches were issued, with all three added to CISA's Known Exploited Vulnerabilities catalog. He has established a pattern of roughly monthly vulnerability disclosures targeting Microsoft products.

TTPs (Tactics, Techniques, Procedures)

BigDiskBuster employs a disk space exhaustion technique to prevent Microsoft Defender platform and signature updates. The tool monitors C:\ drive for new directories under Defender's update paths, then creates hidden temporary files sized to consume all remaining free space when updates begin downloading (T1499.001: Endpoint Denial of Service - OS Exhaustion Flood). It also opens a handle on MRT.exe (Windows Malicious Software Removal Tool) to block Windows Update from replacing it (T1562.001: Impair Defenses - Disable or Modify Tools). The tool deletes the temporary file after update failure and waits for the next update attempt. This differs from Naceri's earlier UnDefend tool (CVE-2026-45498), which used uncontrolled resource consumption rather than disk filling.

Targets & Patterns

BigDiskBuster targets organizations relying on Microsoft Defender for endpoint protection, with particular risk to Information Technology and Cybersecurity sectors that may be slower to detect stale signatures. The tool reportedly works on all supported Windows versions. Targets would be organizations where attackers have already achieved initial access and seek to degrade defensive capabilities before deploying additional payloads. The technique is most dangerous in environments without centralized security monitoring or automated alerting for Defender update failures, as Defender continues running with outdated detection content while appearing functional.

Historical Context

BigDiskBuster is the fourth in a series of Defender-targeting tools released by Naceri since April 2024. His previous three tools—BlueHammer, RedSun, and UnDefend—were all exploited in live attacks before Microsoft issued patches, resulting in CISA KEV catalog additions. UnDefend, disclosed in April 2024 and patched in May 2024 as CVE-2026-45498, blocked definition updates through uncontrolled resource consumption. BigDiskBuster uses a different disk-filling mechanism, suggesting the May 2024 patch does not address this new technique. Naceri has maintained a roughly monthly cadence of Defender and Windows vulnerability disclosures since his departure from Microsoft.

Defensive Recommendations

  • Monitor for repeated Microsoft Defender update failures via event logs and centralized EDR telemetry; configure automated alerts for update status changes
  • Implement disk space monitoring on system volumes (C:\) with alerts for sustained low free space conditions or rapid consumption patterns (T1499.001 detection)
  • Scan for large hidden files in temporary directories, particularly under Defender update paths, using scheduled PowerShell or EDR queries
  • Verify Defender signature and platform currency regularly via Get-MpComputerStatus (AMEngineVersion, AMProductVersion fields) or Windows Security GUI
  • Deploy application control via Windows Defender Application Control (WDAC) or AppLocker to restrict execution of unsigned or unknown binaries (T1562.001 mitigation)