Update defense_evasion_execution_suspicious_explorer_winword.toml (#4533)

Author: Samirbous

rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/09/03"
 integration = ["endpoint", "windows", "m365_defender"]
 maturity = "production"
-updated_date = "2025/01/15"
+updated_date = "2025/03/12"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 
@@ -46,15 +46,16 @@ type = "eql"
 
 query = '''
 process where host.os.type == "windows" and event.type == "start" and
-  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and
-  not (process.name : ("winword.exe", "explorer.exe", "w3wp.exe", "Dism.exe") or
-         process.executable : ("?:\\Windows\\explorer.exe",
-                               "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
-                               "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
-                               "?:\\Windows\\System32\\Dism.exe",
-                               "?:\\Windows\\SysWOW64\\Dism.exe",
-                               "?:\\Windows\\System32\\inetsrv\\w3wp.exe")
-         )
+  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and 
+  not process.executable : ("?:\\Windows\\explorer.exe", 
+                            "?:\\Windows\\SyWOW64\\explorer.exe",
+                            "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
+                            "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
+                            "?:\\Windows\\System32\\Dism.exe", 
+                            "?:\\Windows\\SysWOW64\\Dism.exe",  
+                            "?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
+                            "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
+                            "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe")
 '''
 note = """## Triage and analysis