Naceri's BigDiskBuster stops Defender updating for as long as it runs
Abdelhamid Naceri published the tool over the weekend as the latest move in his dispute with Microsoft over his March 2025 termination, and said it needs only a standard user account on any supported Windows version.
The Watch · Security desk
What happened
- Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released a Microsoft Defender zero-day exploit called BigDiskBuster over the weekend that blocks antivirus updates.
- Naceri said the tool lets standard users block Defender definition updates, and that a standard account is enough to run it.
- The releases are part of an ongoing dispute with Microsoft over what Naceri alleges was his unfair termination in March 2025.
- Two weeks ago he published ShieldCrash, a Defender zero-day that grants SYSTEM access, immediately after Microsoft shipped this month's Patch Tuesday updates.
- Microsoft has fixed ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma among the flaws he disclosed; other issues he reported are still awaiting an official patch.
Why it matters
- What's now possible capability An attacker with standard-user code execution can hold Defender at the detections it already has, at a privilege level below what changing Defender's configuration would require.
- Who's exposed exposure Endpoints where Defender is the only control keep protecting against yesterday's detection set for as long as the process runs, and the gap widens the longer it survives.
- What it limits constraint Until a patch exists, defenders are down to per-endpoint signature version reporting, which many fleets collect but few alert on.
- What it sets up precedent Naceri's pattern of following each Microsoft patch with a bypass means defenders should plan for further unpatched Defender proofs of concept while the termination dispute continues.
Next story · Build · 1h ago
Microsoft ports Defender to the Linux desktop for Plan 2 and E5 or E7 customersConfirmed2 publishers
BigDiskBuster is a tool for an attacker who is already on the machine. It needs code already running there under a standard user account, and Naceri said the block holds only while the tool runs in the background [4]. When the process stops, updating resumes [10]. What it buys an attacker is narrow and real: a payload that the next signature package would flag stays unflagged while the process survives [11].
"Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background," Naceri said [5]. He called the proof of concept "a bit buggy" and said it "needs some rewritting" [2].
Of the eight Defender flaws and tools named in BleepingComputer's account, five have fixes, which leaves BigDiskBuster, ShieldCrash and UnDefend without one [16]. The unfixed ones sit in a bypass chain. Naceri disclosed RoguePlanet in June, Microsoft patched it in July, and Naceri said a later exploit defeated that patch [9]. BleepingComputer classified BigDiskBuster as a denial-of-service zero-day and said a Microsoft spokesperson was not immediately available to comment on it [8].
Signature age is the thing defenders can measure. An endpoint running BigDiskBuster keeps the platform and signature version it had when the tool started, so the gap against what Microsoft is currently shipping widens each day the process stays up [12]. The report is silent on whether Defender or a management console raises anything about that gap [13]. Naceri described the tool as blocking platform and signature updates while protection itself keeps running, so a console check on whether real-time protection is enabled misses the condition [14].
What to watch
- Whether Microsoft ships a fix for BigDiskBuster or treats an update block as outside its servicing bar.
- Whether the technique makes it into commodity loaders or ransomware toolkits, or stays a proof of concept.
- Whether Naceri's next release again lands immediately after a Patch Tuesday, as ShieldCrash did.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence60
Perspective Coverage
4 publishers- Builder
- Builder 23%
- Operator
- Operator 56%
- Investor
- Investor 21%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates, named BigDiskBuster.
- [2]
"This proof of concept is similar to UnDefend, it prevents windows defender from performing platform/signature updates. Seems to work on all supported windows versions but PoC is a bit buggy and needs some rewritting but you get the idea."
- [3]
Naceri said BigDiskBuster allowed standard users to block Defender definition updates.
- [4]
Naceri said BigDiskBuster works on all supported Windows versions and that it needs to run in the background to block Defender updates.
- [5]
"Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background," he said.
- [6]
Two weeks ago, Naceri released another Defender zero-day exploit that grants SYSTEM access, known as ShieldCrash, right after Microsoft rolled out this month's Patch Tuesday security updates.
- [7]
Microsoft has fixed some of the security flaws Naceri disclosed, including ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma, while other security issues he reported still lack an official patch.
- [8]
A Microsoft spokesperson was not immediately available to comment when BleepingComputer reached out about the BigDiskBuster denial-of-service zero-day.
- [9]
RoguePlanet is a Defender flaw Naceri disclosed in June and Microsoft patched in July, and according to Naceri a subsequent exploit bypassed it.
- [10]
Because suppression is conditional on the tool running in the background, Defender update behaviour returns when the process stops.
- [11]
BigDiskBuster requires prior code execution on the endpoint under a standard user account, so it is post-access evasion and not a route to initial access.
- [12]
While the tool runs, the endpoint holds the platform and signature version installed when it started, so the gap against the version Microsoft is currently shipping grows over time.
- [13]
The BleepingComputer report does not state whether Defender or management tooling raises an alert while updates are blocked.
- [14]
The tool is described as preventing platform and signature updates, not as disabling Defender's real-time protection, so a check on protection status would not reveal it.
- [15]
The exploits are being released as part of an ongoing dispute with Microsoft over the researcher's alleged unfair termination in March 2025.
- [16]
The account names eight Defender flaws or tools (BigDiskBuster, UnDefend, ShieldCrash, RoguePlanet, ShieldBreak, YellowKey, GreenPlasma, MiniPlasma) and lists five as fixed, leaving BigDiskBuster, ShieldCrash and UnDefend without a patch.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNew Windows Defender zero-day blocks Microsoft antivirus updates
1 article · September 22, 2026
- securityaffairs.comChaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day
1 article · September 22, 2026
- securityweek.comNightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
1 article · September 22, 2026
- thehackernews.comResearcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
1 article · September 22, 2026
Topics and entities
Entities
- Microsoft
- Abdelhamid Naceri
- Microsoft Defender