diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml
index 089dff4447..09d433ef39 100644
--- a/detections/endpoint/macos_lolbin.yml
+++ b/detections/endpoint/macos_lolbin.yml
@@ -13,6 +13,7 @@ search: '`osquery` name=es_process_events columns.cmdline IN ("find*", "crontab*
   | stats  min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, values(parent) as parent, values(path) as path, 
   values(signing_id) as signing_id,  dc(path) as dc_path by username host
   | rename username as User, cmdline as process, path as process_path
+  | where dc_path > 3
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `macos_lolbin_filter`'
 how_to_implement: This detection uses osquery and endpoint security on MacOS.