Bigdiskbuster - GoKawiil

PoC tool 'BigDiskBuster' blocks Windows Defender updates while keeping it running

Security researcher Abdelhamid Naceri published a proof-of-concept called BigDiskBuster that stops Microsoft Defender from receiving signature updates without exploiting any vulnerability. The roughly 300-line C++ tool monitors the C: drive for Defender update activity and fills nearly all free disk space with a hidden file, causing each update attempt to fail while Defender's service and real-time protection keep running normally. LevelBlue researchers reproduced the technique after the original GitHub page was taken down, confirming it creates what they called a 'silent detection gap.'

darkreading.com · 2026-10-06

Researcher Naceri releases 'BigDiskBuster' zero-day blocking Windows Defender updates

Security researcher Abdelhamid Naceri published a new proof-of-concept exploit called BigDiskBuster that, when run in the background, prevents Microsoft Defender from installing platform or signature updates on any supported Windows version. Naceri describes it as similar to his earlier UnDefend exploit, and says the code is still buggy but demonstrates the concept clearly. This is the latest in a string of nearly a dozen Defender and Windows-related exploits he has released since April 2026 amid an ongoing dispute with Microsoft over his termination.

bleepingcomputer.com · 2026-09-22