How exactly does Windows Defender in Windows 10 determine when to upload your local files to Microsoft?

Question

Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy.

One of the most disturbing things I've found is what I believe is called "automatic sample submission", which means that the built-in anti-virus tool in Windows 10 can, by default, decide to upload any file it deems "potentially risky" to Microsoft, "for further analysis". It also mentions that it doesn't do this for files which "may contain personal data".

But how can it know that? Does it:

1. Simply look at the file extension and only upload .EXE and other "obvious binaries"?
2. Does it ignore the file extension and instead look inside the file to check if it contains executable code?
3. A combination of both?

What happens if I have a word processing document full of private information, but which also has a malicious macro or something accidentally baked (embedded) into it?

What happens if I have an EXE which actually has had all data files baked into it while I'm developing a game as to be a single file? (This is an actual situation I've been in in the past.)

Does it deem the data files for my local PostgreSQL database full of ultra-private information as "potentially dangerous" and upload those?

I can think of numerous situations where even the smartest code in the world would not be able to determine what contains private data or not. And, frankly, I have virtually zero confidence left in Microsoft's judgment at this point, having wasted a huge amount of my life fighting the OS to be able to use it at all. I've found numerous typos in their "stable" releases, making me extremely scared of how much data has been uploaded in spite of all the care I've tried to take to avoid it.

I also remember that it eagerly wanted to re-enable this feature, even harassing me about it. I can imagine that the vast majority of users have no idea about this, let alone have gone through the trouble of force-disabling it.

Answer 1

This is actually a simple and clear policy by Microsoft (but it may have deeper issues):

Even if you choose to accept the Automatic Sample Submission feature remaining enabled, if the file Microsoft is requesting is a data file of any sort, then there should be a prompt to confirm. The only files that Microsoft will send without confirmation are executable files, which for most consumer users are not personally created items.

Now there's another dirty trick to all this:

A document is not an executable, but it may contain executable code. Therefore, MS may consider it an executable and auto-submit it, but they officially state in the case of a Word document or Excel spreadsheet that seems to contain a potentially dangerous macros—you’ll be prompted before it’s sent to Microsoft. The problem here: how they interpret a file with personal information. Some less known programs may use various not widely known extensions which may not be treated as a document holding personal information.

This behavior also may vary depending on updates/versions so the only way to be 100% certain of how it acts is by practically testing.

Also, one should be careful with the Cloud-based protection feature. Specially crafted files may end-up actually doing damage to non-malicious files. Even if such a thing did not yet happen on large scale, one must not exclude for such a possibility.

Harassing is indeed over-exaggerated in Windows 10: it happens in many cases when it comes to 'features' or updates. Example: after it kept stressing me about a reboot required for updating, I bypasses the system and scheduled the reboot for 2099. After that, a desktop notification stared to appear to remind me to reboot before schedule. So this system of spam-like notifications practically acts more annoying than an actual fake anti-virus.