A newly disclosed proof-of-concept (PoC) tool called BigDiskBuster, developed by security researcher MSNightmare (also known as Nightmare-Eclipse), demonstrates a way to disrupt Microsoft Defender Antivirus updates through a denial-of-service tactic. It claims to work across all officially supported Windows versions, though its functionality is still experimental and has not been independently confirmed.
How BigDiskBuster Works
Rather than disabling Defender, BigDiskBuster targets the update mechanism itself. When a Defender platform or definition update directory appears on the C: drive, the tool monitors that location. It then evaluates available disk space and creates a hidden temporary file in the user’s Temp directory, reserving nearly all the free space. If the update process alters or removes files, worker threads rapidly reclaim any new free space to maintain the disk-full state and block the installer from progressing.
Further interference is achieved by locking the Windows Malicious Software Removal Tool executable (MRT.exe) via restrictive sharing permissions, preventing other processes from writing to or deleting that file while MRT.exe remains open. This combination of file locking and disk exhaustion breaks Defender’s ability to stage, install, or roll back updates. Once the update directory vanishes—indicating a failed update—the tool releases the file handle and frees up the space it occupied.
Impact & Detection
The PoC triggers failures in update operations, with screenshots showing error code 0x80070643 and a fatal installation error. While that code can have multiple causes and doesn’t alone prove exploitation, its appearance alongside persistent update failures may signal something amiss.
The risk here is that Defender often appears fully operational, yet without current definitions, its ability to recognize new malware weakens. The tool blocks updates to critical components: the detection content (signatures), the engine, and the platform. Over time, that gap leaves endpoints exposed to threats that they should otherwise block.
What Administrators Should Look For
There are several telltale signs defenders should watch for:
- Sharp drops in available disk space.
- Hidden temporary files created in user Temp folders.
- Persistent exclusive locks on MRT.exe.
- Repeated or unexplained Defender update failures.
Windows logs also provide visibility. Defender records successful signature updates under Event ID 2000 in “Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.” Missing successes, especially alongside recurrent failures, serve as red flags.
Mitigation Steps
Since BigDiskBuster is marked experimental, not every update error should be assumed malicious. Investigators should verify which hosts are affected, collect relevant telemetry (particularly around processes and file handles), and isolate suspicious activity. Freeing up disk space, terminating offending processes, and forcing a trusted update helps restore protection.
Microsoft provides updates via several channels—including Windows Update, WSUS, the Windows Security app, and MpCmdRun.exe. Hosts suspected of compromise should undergo broader incident response workflows to ensure recovery.
Analysis: This PoC reveals how attackers might compromise endpoint protection without traditional malware—by subtly undermining trust in the update infrastructure. As cyber threats grow ever more ingenious, basic systems like update delivery become tempting targets. Security teams must elevate observability of free disk space, file locks, and Defender component status. Longer term, expect pressure on software vendors to verify and harden update integrity mechanisms. Monitoring and rapid response will be the difference between a failed install and a full breach.
