Wazuh Notification.
2026 Sep 11 12:58:03
Received From: wsrv01->3.66.37.34
Rule: 65708 fired (level 12) -> "Cylance: Multiple malware events have been detected on vit-102"
Portion of the log(s):
1 2026-09-11T10:58:05.710000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: preprofile, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 8B1449341A454380816D6C2B7992235FCBB71C29DA8A9BB79E8EA6D50399BE36, MD5: 382A5EFB230BE030A19E72E6A4ECA745, Status: Default, Cylance Score: 100, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
CylancePROTECT.Event.Type: Threat
CylancePROTECT.Event.Name: threat_found
CylancePROTECT.Device.Name: vit-102
CylancePROTECT.IP.Address: 192.168.0.148
CylancePROTECT.Device.ID: 3b8061e4-a3a0-4cf3-b713-40a167db250c
CylancePROTECT.Policy.Name: Core-IT - Protection mode
CylancePROTECT.File.Name: preprofile
CylancePROTECT.File.Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/
CylancePROTECT.Drive.Type: Internal Hard Drive
CylancePROTECT.SHA265: 8B1449341A454380816D6C2B7992235FCBB71C29DA8A9BB79E8EA6D50399BE36
CylancePROTECT.MD5: 382A5EFB230BE030A19E72E6A4ECA745
CylancePROTECT.Status: Default
CylancePROTECT.Cylance.Score: 100
CylancePROTECT.Found.Date: 9/11/2026 10:57:43 AM
CylancePROTECT.File.Type: MacOSExe
CylancePROTECT.Is.Running: False
CylancePROTECT.Auto.Run: False
CylancePROTECT.Detected.By: BackgroundThreatDetection
CylancePROTECT.Is.Malware: False
CylancePROTECT.Is.Unique.To.Cylance: False
CylancePROTECT.Threat.Classification: PUP
1 2026-09-11T10:58:05.636000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: vet, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 7F06C4354995BD5B5B20DCB7C77684BDF9D54591B4A50D86080548504D2C07B0, MD5: 8D6C3D93D98E692A185D6033D8214B08, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
1 2026-09-11T10:58:05.559000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: fix, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 24C90D7EA91036230A0C054F2DC40A2C54E42565F2C7C6C387FD601A5AF5A713, MD5: A93E48ADF08D12861067BE0D9AF6A43F, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
1 2026-09-11T10:58:05.482000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: asm, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 247BF352F8FA9DE8EB640EB28D562949D03A8B6E4632C8AF1F28FBB18464D1FF, MD5: 9AB61F0CE796CF2402EFB9CEB0D336B8, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
1 2026-09-11T10:58:05.405000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: cover, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 1A64B64B23B5B32B76DC56E612A960B2D2E497B8B80565E24D3430F8181407C5, MD5: 5D70BDAB98510C936A70FC023D43F311, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
--END OF NOTIFICATION
Wazuh Notification.
2026 Sep 11 12:58:04
Received From: wsrv01->3.66.37.34
Rule: 65708 fired (level 12) -> "Cylance: Multiple malware events have been detected on vit-102"
Portion of the log(s):
1 2026-09-11T10:58:05.874000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: link, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: D902C2E516560075D90000ABAD15F5EC89F633B5E451E3DC65A318481A62E8FD, MD5: 4E97213009F1B1B551E92D1568C3C394, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
CylancePROTECT.Event.Type: Threat
CylancePROTECT.Event.Name: threat_found
CylancePROTECT.Device.Name: vit-102
CylancePROTECT.IP.Address: 192.168.0.148
CylancePROTECT.Device.ID: 3b8061e4-a3a0-4cf3-b713-40a167db250c
CylancePROTECT.Policy.Name: Core-IT - Protection mode
CylancePROTECT.File.Name: link
CylancePROTECT.File.Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/
CylancePROTECT.Drive.Type: Internal Hard Drive
CylancePROTECT.SHA265: D902C2E516560075D90000ABAD15F5EC89F633B5E451E3DC65A318481A62E8FD
CylancePROTECT.MD5: 4E97213009F1B1B551E92D1568C3C394
CylancePROTECT.Status: Suspicious
CylancePROTECT.Cylance.Score: 30
CylancePROTECT.Found.Date: 9/11/2026 10:57:43 AM
CylancePROTECT.File.Type: MacOSExe
CylancePROTECT.Is.Running: False
CylancePROTECT.Auto.Run: False
CylancePROTECT.Detected.By: BackgroundThreatDetection
CylancePROTECT.Is.Malware: False
CylancePROTECT.Is.Unique.To.Cylance: False
CylancePROTECT.Threat.Classification: PUP
1 2026-09-11T10:58:06.028000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: gvproxy, Path: /opt/homebrew/Cellar/podman/6.1.1/libexec/podman/, Drive Type: Internal Hard Drive, SHA256: 442AB85AD8FDFA8A450DD8D505F063D13E1273C1DD45C6637846BE07ADC1CD7F, MD5: 7F5F79200E5A3DC377E8F3CBB0EDEA9C, Status: Quarantined, Cylance Score: 60, Found Date: 9/11/2026 10:47:57 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
1 2026-09-11T10:58:05.949000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: cgo, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: DFC373C0E7BD11029A0F313C2D516B8F902F11E89C6516BBEC8B20F43535802D, MD5: 0D9107370C198194E34DB0EAF6B3F254, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
1 2026-09-11T10:58:05.798000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: gofmt, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/bin/, Drive Type: Internal Hard Drive, SHA256: 9CD491F4AB78B3B3312D5120F425904D86BA55643EEAF815C36FC8034E999997, MD5: A8D6779F8279282E68F9CBCCF66FB3BC, Status: Suspicious, Cylance Score: 30, Found Date: 9/11/2026 10:57:43 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
1 2026-09-11T10:58:06.101000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: vfkit, Path: /opt/homebrew/Cellar/podman/6.1.1/libexec/podman/, Drive Type: Internal Hard Drive, SHA256: FF88E5115C94C760A8365C4935B83554CB00BFB52C3CE5BA1319C4A70F4142B9, MD5: CC8A353A3BEBC69DF42DCF6B6FD8AEDD, Status: Quarantined, Cylance Score: 30, Found Date: 9/11/2026 10:47:57 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode
--END OF NOTIFICATION
