How StepSecurity Harden Runner Detected Unexpected Microsoft Defender Installation on GitHub-hosted Ubuntu Runners

Microsoft Defender was unexpectedly installed on multiple GitHub‑hosted Ubuntu workflow runs from mid‑July through mid‑August 2025, causing abnormal network traffic that was detected by StepSecurity Harden Runner within hours. The investigation showed that the wdavdaemon process, Defender’s daemon, was making calls to Microsoft endpoints such as x.cp.wd.microsoft[.]com, global.endpoint.security.microsoft[.]com, and wdcp.microsoft[.]com across both enterprise and community tier customers.

GitHub Support confirmed the issue, describing it as an unintended configuration error that had been corrected and mitigations put in place to prevent a recurrence, according to StepSecurity Harden Runner’s reporting. The discovery relied on intelligent baselining and anomaly detection, which flagged calls that had not been part of the normal network behaviour for any job, enabling immediate alerts and automated blocking where endpoints were not in allowed lists.

This incident is cited alongside previous notes on supply‑chain security, underscoring the value of runtime visibility in CI/CD pipelines, as Varun Sharma reported on 2 September 2025.