[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fByMOKdrdqGgaRvoItfhjnpQ8l9am28P6xOYUVYZhHDE":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"252c9e99-54a9-4d29-a831-f095df3eacb7","Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates","researcher-drops-bigdiskbuster-zero-day-poc-that-blocks-microsoft-defender-updat-fa0967","A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in","A zero-day proof-of-concept tool named BigDiskBuster has been released on GitHub, designed to prevent Microsoft Defender from installing critical updates by consuming all available disk space. The tool, developed by former Microsoft researcher Abdelhamid Naceri, aims to keep Defender running but with outdated detection capabilities. While no patch or CVE is currently available, administrators are advised to monitor for update failures and low disk space to detect the technique.","Researcher releases BigDiskBuster PoC to block Microsoft Defender updates by filling disk space.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fresearcher-drops-bigdiskbuster-zero-day.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgf-fkqiHh6b0UEKMHUcsG54QVwJxghIbQLMNWeEG5LWKfUsicLMxisz4Mi8lXdfTdwVYDFpIrCFj5D7-JXXynq8lWhnNn1rJH2t8mgKUeZ4WMePwZktZRnIe2549JW3VXc2HYD9qpsvO8He0J0zCyAzsaRxWtiP46RSrd7jt4QnzKACJhfWnkmyWcFcQs\u002Fs1600\u002Fms-def.jpg","2026-09-22T16:14:04+00:00","2026-09-22T18:00:07.936654+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":19},"Windows",{"name":23,"type":19},"MRT.exe",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"Abdelhamid Naceri","threat_actor",{"name":31,"type":32},"BigDiskBuster","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,41,46],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[25,18,21],{"controls":54,"vendors":137},[55,83,111],{"slug":56,"name":57,"problem":58,"products":59},"patch-management","Automated patch management","Known holes get closed in days, not months.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":56,"product_name":80,"url":81,"description":82},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[88,96,103],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":97,"vendor_name":25,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":112,"name":113,"problem":114,"products":115},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[116,121,129],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":117,"product_name":118,"url":119,"description":120},"cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",[138],{"slug":97,"name":25,"logo_path":98,"roles":139},[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"zero-day-poc-blocks-defender-updates-via-disk-exhaustion","Zero-Day PoC Blocks Defender Updates via Disk Exhaustion","A former Microsoft researcher has released a proof-of-concept tool that exploits a simple but effective technique — filling available disk space — to silently prevent Microsoft Defender from receiving critical signature and engine updates. The attack is insidious because Defender continues to run and appear functional, while its detection capabilities become increasingly stale and ineffective against new threats. This matters because it demonstrates how low-level resource exhaustion can be weaponized to neutralize security controls without triggering obvious alerts. With no patch or CVE currently assigned, defenders must rely on proactive monitoring and compensating controls to detect and respond to this technique.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SC-5: Denial-of-Service Protection","NIST Cybersecurity Framework DE.CM-4: Malicious code detected","ITIL: Availability Management — monitoring of security tool health","ISO\u002FIEC 27001 A.12.2: Protection from malware","ISO\u002FIEC 27001 A.12.6: Technical vulnerability management",{}]