Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands

This report describes BigDiskBuster, a proof-of-concept tool that silently prevents Microsoft Defender from updating by watching for Defender staging directories and immediately allocating essentially all free space on C:, causing update failures without disabling the Defender service; the document includes reproduction details, code-level analysis of NT handles and filesystem watches, detection indicators (handles, GUID-named hidden files, recurring 0x80070643 failures), and mitigation/detection guidance including example SentinelOne queries.