Developer Reports Microsoft Defender Uploaded 217 Files, Including Unreleased Builds
Summary
Developer Garrett Stimpson says Defender logs showed 217 files uploaded in three months, including unreleased builds. The article explains how to check submission logs and settings, while noting that disabling uploads reduces some cloud protection.
Key points
- Stimpson said Defender’s event logs recorded 217 file submissions over three months; 201 were builds of the same Go test program, and a Python script was included.
- He observed MpCmdRun.exe send 224 MB to Microsoft storage in one day; the article notes this was total process traffic, not the size of submitted files.
- Microsoft documentation says automatic submission of files classified as safe is enabled by default and does not prompt for each sample.
- Logs showed the submission setting changed from “Never send” back to automatic submission about two hours after Stimpson turned it off. The cause is unknown; 25 more files were logged afterward.
- The article provides PowerShell commands to review submission events (event 2050), setting changes (event 5007), and the current setting, plus steps to change the setting.
- Microsoft says “Never send” disables Block at First Sight, while metadata is still sent; it also says “Always prompt” and “Never send” lower the device’s protection state.
- The observations came from one PC. Connection records do not reveal encrypted traffic contents, and the article says Microsoft did not respond.
Article Details
- Defense Focus
- Identify Microsoft Defender sample submissions and changes to the automatic sample submission setting, while monitoring whether the configured value persists.
- Detection Methods
- Query Microsoft-Windows-Windows Defender/Operational event 2050 to review files submitted for sample analysis and check for build paths in the event messages.
- Query event 5007 for SubmitSamplesConsent changes and compare the recorded values over time.
- Check the current SubmitSamplesConsent value with Get-MpPreference.
- Use per-app data counters to review MpCmdRun.exe upload volume, noting that the counter does not establish what the encrypted traffic contained.
- Data Sources
- Microsoft-Windows-Windows Defender/Operational event log: events 2050 and 5007
- Get-MpPreference output for SubmitSamplesConsent
- Windows per-app data usage counters
- Defender support log entries marked “command line reported as lowfi”
- Rule Types
- PowerShell Windows event-log queries
- Configuration-change monitoring for SubmitSamplesConsent
- Platforms
- Windows
- Microsoft Defender Antivirus
- Defensive Actions
- Review event 2050 entries for submitted files and paths; account for the possibility that older events have rotated out.
- Check event 5007 again several days after changing the setting to verify that the value persisted.
- Use Windows Security or Set-MpPreference -SubmitSamplesConsent 2 to set sample submission to “Never send”; use 0 for “Always prompt.”
- On Windows Pro, Enterprise, or Education, configure “Never send” through Group Policy to reduce the chance of an accidental setting change.
- Consider the protection trade-off: “Never send” disables Block at First Sight, and Microsoft says “Always prompt” and “Never send” lower the device’s protection state.
People
Vendors
Products
Microsoft Defender Antimalware PlatformDeveloper Garrett Stimpson wrote on 11 November that Microsoft Defender’s “Automatic sample submission” uploaded 217 files from his PC over three months, going by Defender’s own event log.Microsoft Defender Antivirus(gpedit.msc), go to Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → MAPS, open “Send file samples when further analysis is required”, set it to Enabled andWindows SecurityA quick scan started under his account nine seconds after the switch, and he names a click in Windows Security as one possible explanation.