CylancePROTECT Desktop
threat classifications

Each day, the

CylancePROTECT

cloud services will classify hundreds of threats as either malware or potentially unwanted programs (PUPs). By selecting this option, you are subscribing to be notified when these events occur. For full descriptions of each threat class and subclass, read the Threat Classification FAQ knowledge base article.

Field	Value	Description
Event Type	ThreatClassification	This is a threat classification event.
Event Name	ThreatUpdated	The threat details have been updated.
MD5	[varies]	This is the MD5 hash for the file.
SHA256	[varies]	This is the SHA256 hash for the file.
Threat Class	Dual Use	The file can be used for malicious and non-malicious purposes.
	File Unavailable	The file is unavailable for analysis. For example, the file is too large to upload.
	Malware	The file has been identified as malicious.
	Possible PUP	The file might be a potentially unwanted program (PUP).
	PUP	The file has been identified as a possible potentially unwanted program (PUP).
	Trusted	The file has been identified as safe.
Threat Subclass	Adware	The file has advertisements or unwanted bundled add-ons.
	Backdoor	The file provides unauthorized access.
	Bot	The file contains malware that connects to a botnet server.
	Corrupt	The file is malformed or unable to run.
	Crack	The file is altered to bypass licensing.
	Downloader	The file contains malware that downloads data.
	Dropper	The file contains malware that installs other malware.
	Exploit	The file attacks a specific vulnerability.
	Fake Alert	The file contains malware that appears to be legitimate security software.
	Fake AV	The file contains malware that appears to be legitimate security software.
	Game	This is a game file.
	Generic	This file does not fit into any existing category.
	Hacking Tool	This file is a hacking tool.
	Infostealer	This file records login credentials and other sensitive information.
	Keygen	This file generates product keys.
	Monitoring Tool	This file tracks a user’s activities.
	Other	This is a category used for PUPs that don’t fit anything else.
	Parasitic	This threat is spread by attacking other programs.
	Pass Crack	This file is used to reveal passwords.
	Portable Application	This file is designed to run without needing installation.
	Ransom	This file restricts access.
	Remnant	These are remnants post removal.
	Remote Access	This file can access another system remotely.
	Rootkit	This file avoids detection.
	Scripting Tool	This is any script that can run as if it were an executable.
	Tool	These are administrative features used to attack or intrude.
	Toolbar	This is any technology that places additional buttons or input boxes on-screen.
	Trojan	This file disguises itself as legitimate software.
	Virus	This file inserts or appends itself to other files.
	Worm	This file propagates by copying itself to another device.

Example message for threat classifications

BlackBerry Protect Desktop: Event Type: ThreatClassification, Event Name: ThreatUpdated, SHA256: 1218493137321C1D1F897B0C25BEF17CDD0BE9C99B84B4DD8B51EAC8F9794F65, Threat Classification: Malware - Worm

Section:

CylancePROTECT Desktop event types

CylancePROTECT Desktop threat classifications

CylancePROTECT Desktop
threat classifications