[Rule Tuning] Reducing FP and adding detection gap in rule Dumping Account Hashes via Built-In Commands (#6187)

* fine_tuning_rule

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

(cherry picked from commit 4d25d522eb)

rules/macos/credential_access_dumping_hashes_bi_cmds.toml

@@ -2,7 +2,7 @@
 creation_date = "2021/01/25"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/05/26"
 
 [rule]
 author = ["Elastic"]
@@ -60,8 +60,15 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where host.os.type == "macos" and event.type in ("start", "process_started") and
- process.name in ("defaults", "mkpassdb") and process.args like~ ("ShadowHashData", "-dump")
+process where host.os.type == "macos" and event.type in ("start","process_started") and (
+  (process.name == "defaults" and process.args like~ "ShadowHashData") or
+  (process.name == "mkpassdb" and process.args == "-dump") or
+  (process.name == "dscl" and process.args like~ "ShadowHashData") or
+  (
+    process.name in ("plutil","cat","strings","xxd","head") and
+    process.args like "/var/db/dslocal/nodes/Default/users/*.plist"
+  )
+)
 '''
 note = """## Triage and analysis