Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates

A former Microsoft security researcher, Abdelhamid Naceri, publicly released a zero-day proof-of-concept tool called BigDiskBuster that blocks Microsoft Defender from installing platform and signature updates by consuming all available disk space. The tool monitors Defender's update paths and creates a large hidden temporary file to prevent update downloads, deleting it once the update attempt fails. This denial-of-service technique could leave Defender with outdated detection capabilities, increasing risk of undetected malware. No patch or CVE has been issued, and the tool reportedly works across all supported Windows versions.

AI-extracted · verify before operational use