diff --git a/rules/macos/execution_shell_execution_via_apple_scripting.toml b/rules/macos/execution_shell_execution_via_apple_scripting.toml
index 8e784e975..676757576 100644
--- a/rules/macos/execution_shell_execution_via_apple_scripting.toml
+++ b/rules/macos/execution_shell_execution_via_apple_scripting.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/12/07"
 maturity = "production"
-updated_date = "2021/03/03"
+updated_date = "2021/06/22"
 
 [rule]
 author = ["Elastic"]
@@ -27,7 +27,7 @@ type = "eql"
 query = '''
 sequence by host.id with maxspan=5s
  [process where event.type in ("start", "process_started", "info") and process.name == "osascript"] by process.pid
- [process where event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.ppid
+ [process where event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.parent.pid
 '''
 
 
diff --git a/rules/macos/persistence_folder_action_scripts_runtime.toml b/rules/macos/persistence_folder_action_scripts_runtime.toml
index 98724350c..c639b9e6d 100644
--- a/rules/macos/persistence_folder_action_scripts_runtime.toml
+++ b/rules/macos/persistence_folder_action_scripts_runtime.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/12/07"
 maturity = "production"
-updated_date = "2021/03/03"
+updated_date = "2021/06/22"
 
 [rule]
 author = ["Elastic"]
@@ -25,7 +25,7 @@ type = "eql"
 query = '''
 sequence by host.id with maxspan=5s
  [process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
- [process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.ppid
+ [process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.parent.pid
 '''