macOS process calls IOPMAssertionCreateWithName to block sleep
Detects the creation of power management assertions using the IOPMAssertionCreateWithName API by processes other than standard system binaries. Attackers may use this technique to prevent a system from sleeping, which can be leveraged to maintain persistence or ensure that malicious background activities continue without interruption.
Microsoft Sentinel (KQL)
