Microsoft Defender will upload suspicious files to Microsoft to determine if they are malicious. Some antivirus users consider this a privacy risk and may want to disable it. Windows Defender Antivirus will automatically upload executables and scripts but warn the user first to upload a file that may contain personal information, such as a document. Microsoft’s cloud-based protection will analyze the file, and if it is determined to be malicious, cause Microsoft Defender to quarantine the file on the device. In 2015, Kaspersky disclosed that they had detected a suite of NSA surveillance and hacking tools associated with the mysterious “Equation Group”””
Source: https://www.bleepingcomputer.com/news/security/how-to-stop-windows-10-defender-from-uploading-files-to-microsoft/