diff --git a/rules/macos/persistence_folder_action_scripts_runtime.toml b/rules/macos/persistence_folder_action_scripts_runtime.toml
index c639b9e6d..a6c19cdf5 100644
--- a/rules/macos/persistence_folder_action_scripts_runtime.toml
+++ b/rules/macos/persistence_folder_action_scripts_runtime.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/12/07"
 maturity = "production"
-updated_date = "2021/06/22"
+updated_date = "2022/01/25"
 
 [rule]
 author = ["Elastic"]
@@ -25,7 +25,7 @@ type = "eql"
 query = '''
 sequence by host.id with maxspan=5s
  [process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
- [process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.parent.pid
+ [process where event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh")] by process.parent.pid
 '''