BigDiskBuster: Zero-Day Tool Blocks Microsoft Defender Updates

A former Microsoft security researcher has published a zero-day proof-of-concept tool that can block Microsoft Defender updates by filling all available disk space. The tool, called BigDiskBuster, was published on GitHub on September 19 and its author, Abdelhamid Naceri, claims it works on all supported Windows versions.

Naceri was dismissed from Microsoft's Security Response Center in 2024 and has since been releasing exploits without coordinating with the company. His previous tools, including BlueHammer, RedSun, and UnDefend, were used in live intrusions before being patched by Microsoft.

BigDiskBuster works by creating a hidden temporary file sized to fill all remaining free space on the C: ive when Defender begins downloading an update. This causes the update to fail, and the tool then deletes the file and waits for the next attempt.