The automated sample transmission relies on a built-in rule that classifies compiled files and scripts as safe to upload if they lack obvious personal identifying data. An analysis revealed that one system sent 217 sample submissions across a three-month span, including private Go builds and a deleted Python script. Defender's command-line utility transmitted 2.8 GB in 30 days, representing roughly 80 percent of the system's outbound traffic to Microsoft. Attempts to permanently disable the feature failed after PowerShell changes mysteriously reverted hours later.
Key points
Microsoft Defender automatically transmits unreleased executables and scripts to Azure st…: Microsoft Defender automatically transmits unreleased executables and scripts to Azure storage under its default sample submission settings.
Manual changes to disable automated sample uploads through PowerShell reverted to the def…: Manual changes to disable automated sample uploads through PowerShell reverted to the default configuration within approximately two hours.
Local support logs systematically captured sensitive context including full curl commands…: Local support logs systematically captured sensitive context including full curl commands, PowerShell strings, and explicit project directory paths.
Sources checked by our analysis pipeline: 1
Caught Microsoft Red-Handed with Hodometer
Microsoft Defender uploaded programs I’d written and hadn’t released. Its event log recorded 217 sample submissions from my PC over three months. I hadn’t seen a prompt for any of them.
I found them while investigating a lagging connection with Hodometer, a Windows tray tool I built to track traffic by process and destination.
Microsoft’s programs accounted for 4.7 percent of downloads and 4.5 percent of uploads across about 100 hours. Most of the traffic was my browser, development tools and game patches. Defender’s uploads stood out when I looked at the individual processes.
What Defender uploaded
MpCmdRun.exe
, Defender’s command-line utility, sent 224 MB to Azure storage in one day. The uploads came in bursts of around 28 MB a minute, with very little coming back.
The traffic was encrypted. To identify the files, I checked Defender’s Operational log. Event 2050 records sample submissions with a file name and SHA-256 hash. The message on my machine read:
Microsoft Defender Antivirus has uploaded a file for further analysis
Community feedback gathered from 1,385 respondents will guide the organization's upcoming 2028–2032 Strategic Plan following high ratings across core services and industry reputation. While overall satisfaction remains strong, regional knowledge gaps surrounding leadership processes have prompted calls for clearer organizational communication. In response, leadership is prioritizing practical deployment assistance and training to support regional Internet development.
As Singapore prepares for the upcoming northeast monsoon season, national water agency PUB is modernising its emergency response to safeguard low-lying areas vulnerable to flash floods. Despite decades of infrastructure work shrinking the nation's flood-prone zones to under 25 hectares, localised inundations remain an operational challenge. The new technology adoption aims to enhance worker safety while speeding up drainage efforts during extreme weather events.
The amphibious machine enables Singapore's national water agency to clear submerged basements, underground carparks, and tunnels without placing human personnel in dangerous conditions. By doubling the pumping capacity of existing portable units and deploying across difficult terrain within minutes, the unit accelerates crisis response times. This strategic upgrade helps safeguard critical urban infrastructure as seasonal storms increasingly overwhelm traditional drainage networks.