diff --git a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
index 90ccf139c..e6b7bc643 100644
--- a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
+++ b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/09/03"
 integration = ["endpoint", "windows", "m365_defender"]
 maturity = "production"
-updated_date = "2025/03/20"
+updated_date = "2025/04/16"
 
 [rule]
 author = ["Elastic"]
@@ -87,9 +87,9 @@ query = '''
 process where host.os.type == "windows" and event.type == "start" and
   process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and 
   not process.executable : ("?:\\Windows\\explorer.exe", 
-                            "?:\\Windows\\SyWOW64\\explorer.exe",
+                            "?:\\Windows\\SysWOW64\\explorer.exe",
                             "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
-                            "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
+                            "?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
                             "?:\\Windows\\System32\\Dism.exe", 
                             "?:\\Windows\\SysWOW64\\Dism.exe",  
                             "?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",