Garrett Stimpson investigated unexpected traffic on his Windows development machine and found that Microsoft Defender had submitted unreleased builds for analysis. He combined process-level traffic records with Defender’s logs to identify what had happened.
- Event 2050 recorded 217 sample submissions over three months. Most were fresh builds of one Go test program.
- Microsoft’s default automatically submits files it considers unlikely to contain personal information. That includes executables, even when their authors consider them confidential.
- After Stimpson disabled sample submission, the setting later returned to its previous value. The available logs did not establish why.
- Event 2050 shows retained submission records; Event 5007 can show changes to
SubmitSamplesConsent. A connection to Azure storage alone does not establish which file was sent.
The distinction between observed uploads and unanswered questions matters: an attempted upload of a database temporary file failed, and local command-line logs did not prove what Microsoft received over the network.
Developers can review their own submission logs and policy. Disabling automatic samples also gives up Defender’s block-at-first-sight protection based on sample analysis, while detection metadata is still sent.