Wazuh Notification. 2026 Sep 11 13:31:01 Received From: wsrv01->3.66.37.34 Rule: 65708 fired (level 12) -> "Cylance: Multiple malware events have been detected on vit-102" Portion of the log(s): 1 2026-09-11T11:31:03.354000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: link, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: D902C2E516560075D90000ABAD15F5EC89F633B5E451E3DC65A318481A62E8FD, MD5: 4E97213009F1B1B551E92D1568C3C394, Status: FileRemoved, Cylance Score: 30, Found Date: 9/11/2026 10:57:44 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode CylancePROTECT.Event.Type: Threat CylancePROTECT.Event.Name: threat_cleared CylancePROTECT.Device.Name: vit-102 CylancePROTECT.IP.Address: 192.168.0.148 CylancePROTECT.Device.ID: 3b8061e4-a3a0-4cf3-b713-40a167db250c CylancePROTECT.Policy.Name: Core-IT - Protection mode CylancePROTECT.File.Name: link CylancePROTECT.File.Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/ CylancePROTECT.Drive.Type: Internal Hard Drive CylancePROTECT.SHA265: D902C2E516560075D90000ABAD15F5EC89F633B5E451E3DC65A318481A62E8FD CylancePROTECT.MD5: 4E97213009F1B1B551E92D1568C3C394 CylancePROTECT.Status: FileRemoved CylancePROTECT.Cylance.Score: 30 CylancePROTECT.Found.Date: 9/11/2026 10:57:44 AM CylancePROTECT.File.Type: MacOSExe CylancePROTECT.Is.Running: False CylancePROTECT.Auto.Run: False CylancePROTECT.Detected.By: BackgroundThreatDetection CylancePROTECT.Is.Malware: False CylancePROTECT.Is.Unique.To.Cylance: False CylancePROTECT.Threat.Classification: PUP 1 2026-09-11T11:31:03.150000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: preprofile, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 8B1449341A454380816D6C2B7992235FCBB71C29DA8A9BB79E8EA6D50399BE36, MD5: 382A5EFB230BE030A19E72E6A4ECA745, Status: FileRemoved, Cylance Score: 100, Found Date: 9/11/2026 10:57:44 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode 1 2026-09-11T11:31:03.058000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: fix, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 24C90D7EA91036230A0C054F2DC40A2C54E42565F2C7C6C387FD601A5AF5A713, MD5: A93E48ADF08D12861067BE0D9AF6A43F, Status: FileRemoved, Cylance Score: 30, Found Date: 9/11/2026 10:57:44 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode 1 2026-09-11T11:31:02.975000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: asm, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 247BF352F8FA9DE8EB640EB28D562949D03A8B6E4632C8AF1F28FBB18464D1FF, MD5: 9AB61F0CE796CF2402EFB9CEB0D336B8, Status: FileRemoved, Cylance Score: 30, Found Date: 9/11/2026 10:57:44 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode 1 2026-09-11T11:31:02.898000+00:00 sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_cleared, Device Name: vit-102, IP Address: (192.168.0.148, 2a01:e0a:b10:54d0:18cd:275e:c21c:648a, 2a01:e0a:b10:54d0:6dbc:fe3a:a224:2350), File Name: cover, Path: /opt/homebrew/Cellar/go/1.27.1/libexec/pkg/tool/darwin_arm64/, Drive Type: Internal Hard Drive, SHA256: 1A64B64B23B5B32B76DC56E612A960B2D2E497B8B80565E24D3430F8181407C5, MD5: 5D70BDAB98510C936A70FC023D43F311, Status: FileRemoved, Cylance Score: 30, Found Date: 9/11/2026 10:57:44 AM, File Type: MacOSExe, Is Running: False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names: (Core-IT Mac), Is Malware: False, Is Unique To Cylance: False, Threat Classification: PUP - Generic, Device Id: 3b8061e4-a3a0-4cf3-b713-40a167db250c, Policy Name: Core-IT - Protection mode --END OF NOTIFICATION