We had it happen on our delivery controllers from a windows defender definition update