Wazuh Notification. 2026 Sep 08 17:07:27 Received From: wsrv01->3.127.141.35 Rule: 65708 fired (level 12) -> "Cylance: Multiple malware events have been detected on mac-35101" Portion of the log(s): 1 2026-09-08T15:07:28.693000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: asm, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 9FB703C3A354A298B2ECFBF767F9E62FB72101E481B650DE93286A38AC5B14E9, MD5: 3ED33F0247DED539244BD6B2A0A0FF6F, Status: FileRemoved, Cylance Score: 100, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode CylancePROTECT.Event.Type: Threat CylancePROTECT.Event.Name: threat_cleared CylancePROTECT.Device.Name: mac-35101 CylancePROTECT.IP.Address: 10.16.38.29 CylancePROTECT.Device.ID: 48f6b0e4-b38f-4edb-8689-400f5bb6865e CylancePROTECT.Policy.Name: Core-IT - Protection mode CylancePROTECT.File.Name: asm CylancePROTECT.File.Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/ CylancePROTECT.Drive.Type: Internal Hard Drive CylancePROTECT.SHA265: 9FB703C3A354A298B2ECFBF767F9E62FB72101E481B650DE93286A38AC5B14E9 CylancePROTECT.MD5: 3ED33F0247DED539244BD6B2A0A0FF6F CylancePROTECT.Status: FileRemoved CylancePROTECT.Cylance.Score: 100 CylancePROTECT.Found.Date: 9/8/2026 1:50:20 PM CylancePROTECT.File.Type: MacOSExe CylancePROTECT.Is.Running: False CylancePROTECT.Auto.Run: False CylancePROTECT.Detected.By: BackgroundThreatDetection CylancePROTECT.Is.Malware: False CylancePROTECT.Is.Unique.To.Cylance: False CylancePROTECT.Threat.Classification: PUP 1 2026-09-08T15:07:28.637000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: cgo, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 7794D92E441DED47A29C4D5E9F023A0687403A4E4F888FE695FAD6E13627A056, MD5: BC90641C26AC7BA452C92C6C51ECFC4F, Status: FileRemoved, Cylance Score: 100, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode 1 2026-09-08T15:07:28.579000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: link, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 7587E2CBEA3E8774E8B34CB260BB2885574B9D8A2A57B93BF4A684D336008345, MD5: 059C455A9AACC2DE649FB3B3EED4DD33, Status: FileRemoved, Cylance Score: 100, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode 1 2026-09-08T15:07:28.521000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: llvm-config, Path: /usr/local/Cellar/llvm@22/22.1.8/bin/, Drive Type: Internal Hard Drive, SHA256: 5B1FF3B3A3055EF9C8AF79E78D64F375429F22A821E657E6E89B364CA135BDF6, MD5: AFB8FF355F20A40ECF92CFF8CE187AF0, Status: FileRemoved, Cylance Score: 30, Found Date: 9/8/2026 2:26:02 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: True, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode 1 2026-09-08T15:07:28.462000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: compile, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 0CC46B59A4843BFF3A3FECF6317AAEC6EA3C62CD05980B620FED07429106210A, MD5: DAC21A3F0AFD7A95497EFB83FCFA256D, Status: FileRemoved, Cylance Score: 60, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode --END OF NOTIFICATION