Security1 publisher2 min readPublished
Naceri's BigDiskBuster stops Defender updating for as long as it runs
Abdelhamid Naceri published the tool over the weekend as the latest move in his dispute with Microsoft over his March 2025 termination, and said it needs only a standard user account on any supported Windows version.
The Watch · Security desk
What happened
- Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released a Microsoft Defender zero-day exploit called BigDiskBuster over the weekend that blocks antivirus updates.
- Naceri said the tool lets standard users block Defender definition updates, and that a standard account is enough to run it.
- The releases are part of an ongoing dispute with Microsoft over what Naceri alleges was his unfair termination in March 2025.
- Two weeks ago he published ShieldCrash, a Defender zero-day that grants SYSTEM access, immediately after Microsoft shipped this month's Patch Tuesday updates.
- Microsoft has fixed ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma among the flaws he disclosed; other issues he reported are still awaiting an official patch.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability An attacker with standard-user code execution can hold Defender at the detections it already has, at a privilege level below what changing Defender's configuration would require.
- exposure Endpoints where Defender is the only control keep protecting against yesterday's detection set for as long as the process runs, and the gap widens the longer it survives.
- constraint Until a patch exists, defenders are down to per-endpoint signature version reporting, which many fleets collect but few alert on.
- precedent Naceri's pattern of following each Microsoft patch with a bypass means defenders should plan for further unpatched Defender proofs of concept while the termination dispute continues.
BigDiskBuster is a tool for an attacker who is already on the machine. It needs code already running there under a standard user account, and Naceri said the block holds only while the tool runs in the background [3]. When the process stops, updating resumes [12]. What it buys an attacker is narrow and real: a payload that the next signature package would flag stays unflagged while the process survives [13].
"Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background," Naceri said [4]. He called the proof of concept "a bit buggy" and said it "needs some rewritting" [5].
Of the eight Defender flaws and tools named in BleepingComputer's account, five have fixes, which leaves BigDiskBuster, ShieldCrash and UnDefend without one [11]. The unfixed ones sit in a bypass chain. Naceri disclosed RoguePlanet in June, Microsoft patched it in July, and Naceri said a later exploit defeated that patch [8]. BleepingComputer classified BigDiskBuster as a denial-of-service zero-day and said a Microsoft spokesperson was not immediately available to comment on it [10].
Signature age is the thing defenders can measure. An endpoint running BigDiskBuster keeps the platform and signature version it had when the tool started, so the gap against what Microsoft is currently shipping widens each day the process stays up [14]. The report is silent on whether Defender or a management console raises anything about that gap [15]. Naceri described the tool as blocking platform and signature updates while protection itself keeps running, so a console check on whether real-time protection is enabled misses the condition [16].
What to watch
- Whether Microsoft ships a fix for BigDiskBuster or treats an update block as outside its servicing bar.
- Whether the technique makes it into commodity loaders or ransomware toolkits, or stays a proof of concept.
- Whether Naceri's next release again lands immediately after a Patch Tuesday, as ShieldCrash did.