Plan
active
BigDiskBuster PoC Blocks Defender Updates via Disk Exhaustion
- Engineer — Plan: Public PoC on GitHub means this disk-exhaustion denial-of-defense technique is accessible to attackers now; no patch exists, so implement disk-space monitoring and alerting on Defender signature/platform update failures as a compensating control on Windows endpoints.
- SOC/IR — Plan: This technique maps to ATT&CK T1562 (Impair Defenses) and could leave endpoints running stale signatures undetected; build a detection correlating sudden disk-space consumption with Defender update failure events, and add Defender update staleness to your alert baseline.
- Leader — Learn: A PoC that can silently stall AV signature updates highlights a defense-in-depth gap, but with no active exploitation or vendor patch it doesn’t require leadership action this week; useful context for conversations about monitoring coverage and compensating controls.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.