macOS.Gaslight IOPMAssertionCreateWithName Sleep Prevention with ps/sysctl/sw_vers Enumeration

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects anomalous system and process enumeration activity characteristic of the macOS.Gaslight threat, specifically looking for repeated execution of diagnostic commands like ps, sysctl, uname, and sw_vers in a short timeframe, which suggests an attempt to profile the infected host environment.