BigDiskBuster PoC Exploits Windows Defender Update Mechanism for DoS
A new proof-of-concept tool, BigDiskBuster, targets Microsoft Defender Antivirus by exhausting disk space and locking files, preventing critical security updates.
Security researcher MSNightmare, also known as Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept denial-of-service (DoS) technique designed to disrupt Microsoft Defender Antivirus's ability to perform essential updates. This tool aims to prevent the antivirus software from completing its security-intelligence and platform updates, potentially leaving endpoints vulnerable to emerging threats.
BigDiskBuster operates by monitoring specific directories related to Defender's Platform and Definition Updates on the C: volume. When the tool detects the appearance of a new update directory, it checks the available disk space. If sufficient space is present, it creates a hidden file in the user's temporary directory, requesting to consume all remaining free space. This disk exhaustion tactic directly interferes with the update process, as the installer requires storage to download and stage update components.
Further complicating the update process, BigDiskBuster employs a file-locking mechanism. It opens the Windows Malicious Software Removal Tool binary, MRT.exe, with restrictive sharing permissions. This action prevents other processes, including the Defender updater, from obtaining the necessary write or delete access to files within the update directories while the handle remains open. The combination of disk space exhaustion and file locking effectively halts the staging, installation, and rollback operations for Defender updates.
The researcher claims that BigDiskBuster works across all supported Windows versions, though the proof-of-concept code is described as experimental and potentially buggy. Compatibility has not been independently verified. The tool does not disable Defender directly but rather makes it unable to perform its core update functions, leading to a state where the system may appear protected but is actually falling behind on critical threat intelligence.
When the monitored Defender update directory is no longer detected, BigDiskBuster interprets this as a failed update. It then closes its temporary file handles and releases the allocated disk space. A screenshot provided by the researcher shows a Windows Security alert indicating a "Protection definition update failed" with error code 0x80070643, a generic fatal installation error. It is important to note that this error code alone should not be treated as definitive proof of exploitation, as it can stem from various installation issues.
The security implications of such an attack are significant. Microsoft Defender relies on regular updates for its security intelligence, engine, and platform components to effectively detect and mitigate the latest malware. By blocking these updates, an endpoint's ability to recognize and defend against new and evolving threats can be severely compromised, even if the antivirus software appears to be running normally.
Administrators are advised to monitor for unusual disk space collapses, the presence of hidden files in user temporary directories, persistent handles to MRT.exe, and recurring Defender update failures. Microsoft provides detailed logs for update events under the Applications and Services Logs, specifically within Microsoft, Windows, Windows Defender, Operational. Event ID 2000, for instance, indicates a successful signature update, making a lack of such events or recurring failures a potential hunting signal.
Given that BigDiskBuster is an experimental proof-of-concept, organizations should exercise caution and validate affected hosts before assuming an attack. Recommended response actions include preserving relevant telemetry, terminating the suspicious process if identified, recovering disk capacity, and forcing a trusted update through official channels such as Windows Update, WSUS, or the Windows Security app. Broader incident response review may also be necessary for compromised systems.