diff --git a/detection/discovery/unexpected-netutil-calls-macos.sql b/detection/discovery/unexpected-netutil-calls-macos.sql
index 70ceb64..b7ca810 100644
--- a/detection/discovery/unexpected-netutil-calls-macos.sql
+++ b/detection/discovery/unexpected-netutil-calls-macos.sql
@@ -77,6 +77,7 @@ WHERE
   pe.path IN (
     '/sbin/ifconfig',
     '/usr/sbin/netstat',
+    '/usr/bin/nscurl',
     '/sbin/pfctl',
     '/usr/libexec/ApplicationFirewall/socketfilterfw'
   )