Wazuh Notification. 2026 Sep 08 16:22:06 Received From: wsrv01->3.78.57.226 Rule: 65708 fired (level 12) -> "Cylance: Multiple malware events have been detected on mac-35101" Portion of the log(s): 1 2026-09-08T14:22:07.555000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: fix, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: A3B21BEDAEF5240C023A8F4BCAAEF7D7BAF48475338519324C8ED2A158AF67E4, MD5: 63C7D5FFD2641E915D7E0C6C6207DBE0, Status: Quarantined, Cylance Score: 60, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode CylancePROTECT.Event.Type: Threat CylancePROTECT.Event.Name: threat_changed CylancePROTECT.Device.Name: mac-35101 CylancePROTECT.IP.Address: 10.16.38.29 CylancePROTECT.Device.ID: 48f6b0e4-b38f-4edb-8689-400f5bb6865e CylancePROTECT.Policy.Name: Core-IT - Protection mode CylancePROTECT.File.Name: fix CylancePROTECT.File.Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/ CylancePROTECT.Drive.Type: Internal Hard Drive CylancePROTECT.SHA265: A3B21BEDAEF5240C023A8F4BCAAEF7D7BAF48475338519324C8ED2A158AF67E4 CylancePROTECT.MD5: 63C7D5FFD2641E915D7E0C6C6207DBE0 CylancePROTECT.Status: Quarantined CylancePROTECT.Cylance.Score: 60 CylancePROTECT.Found.Date: 9/8/2026 1:50:20 PM CylancePROTECT.File.Type: MacOSExe CylancePROTECT.Is.Running: False CylancePROTECT.Auto.Run: False CylancePROTECT.Detected.By: BackgroundThreatDetection CylancePROTECT.Is.Malware: False CylancePROTECT.Is.Unique.To.Cylance: False CylancePROTECT.Threat.Classification: PUP 1 2026-09-08T14:22:07.497000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: asm, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 9FB703C3A354A298B2ECFBF767F9E62FB72101E481B650DE93286A38AC5B14E9, MD5: 3ED33F0247DED539244BD6B2A0A0FF6F, Status: Quarantined, Cylance Score: 100, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode 1 2026-09-08T14:22:07.438000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: cgo, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 7794D92E441DED47A29C4D5E9F023A0687403A4E4F888FE695FAD6E13627A056, MD5: BC90641C26AC7BA452C92C6C51ECFC4F, Status: Quarantined, Cylance Score: 100, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode 1 2026-09-08T14:22:07.390000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: link, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 7587E2CBEA3E8774E8B34CB260BB2885574B9D8A2A57B93BF4A684D336008345, MD5: 059C455A9AACC2DE649FB3B3EED4DD33, Status: Quarantined, Cylance Score: 100, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode 1 2026-09-08T14:22:07.337000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_changed, Device Name: mac-35101, IP Address: (10.16.38.29, 192.168.97.0, 192.168.139.3, 192.168.147.0, fd07:b51a:cc66:0:a617:db5e:ab7:e9f1), File Name: compile, Path: /usr/local/Cellar/go/1.27.1/libexec/pkg/tool/darwin_amd64/, Drive Type: Internal Hard Drive, SHA256: 0CC46B59A4843BFF3A3FECF6317AAEC6EA3C62CD05980B620FED07429106210A, MD5: DAC21A3F0AFD7A95497EFB83FCFA256D, Status: Quarantined, Cylance Score: 60, Found Date: 9/8/2026 1:50:20 PM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 48f6b0e4-b38f-4edb-8689-400f5bb6865e, Policy Name: Core-IT - Protection mode --END OF NOTIFICATION