diff --git a/rules/macos/credential_access_dumping_hashes_bi_cmds.toml b/rules/macos/credential_access_dumping_hashes_bi_cmds.toml
index f3f850663..9e3c8e681 100644
--- a/rules/macos/credential_access_dumping_hashes_bi_cmds.toml
+++ b/rules/macos/credential_access_dumping_hashes_bi_cmds.toml
@@ -2,7 +2,7 @@
 creation_date = "2021/01/25"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/05/26"
 
 [rule]
 author = ["Elastic"]
@@ -60,8 +60,15 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where host.os.type == "macos" and event.type in ("start", "process_started") and
- process.name in ("defaults", "mkpassdb") and process.args like~ ("ShadowHashData", "-dump")
+process where host.os.type == "macos" and event.type in ("start","process_started") and (
+  (process.name == "defaults" and process.args like~ "ShadowHashData") or
+  (process.name == "mkpassdb" and process.args == "-dump") or
+  (process.name == "dscl" and process.args like~ "ShadowHashData") or
+  (
+    process.name in ("plutil","cat","strings","xxd","head") and
+    process.args like "/var/db/dslocal/nodes/Default/users/*.plist"
+  )
+)
 '''
 note = """## Triage and analysis