v2.336.0 gets quarantined by Windows Defender on Windows Server
Open
Nobody has claimed this yet.
bug
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 1.4k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 24
Description
Describe the bug
To Reproduce
Steps to reproduce the behavior:
- Download https://github.com/actions/runner/releases#release-v2.336.0
- Unzip
- Observe that Runner.Worker.dll gets quarantined by Windows Defender
Runner Version and Platform
Runner version: v2.336.0
Windows Server 2019 Standard version 1809. OS build 17763.9020
| Component | Version |
|---|---|
| Defender Platform | 4.18.26060.3008 |
| Defender Engine | 1.1.26060.3008 |
| Defender Service | 4.18.26060.3008 |
| Security Intelligence (Signatures) | 1.455.271.0 |
| Real-time Protection | Enabled |
| Behavior Monitoring | Enabled |
| Network Inspection (NIS) | Enabled |
Additional Information
- Running Mode: Normal
- Signatures Out of Date: No
- Last Quick Scan: 2026-07-23 04:32–04:41
- Full Scan: No recorded full scan (
FullScanAge = 4294967295) - Tamper Protection: Disabled
- Virtual Machine: Yes
- Reboot Required: No
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the v2.336.0 release download and extraction on Windows Server 2019 with the listed Defender versions, focusing on Runner.Worker.dll. Investigate the release artifact and determine whether a subsequent runner release or Defender scan still quarantines that DLL; done means the released runner is no longer quarantined in the reported environment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100