diff --git a/rules/windows/execution_windows_script_from_internet.toml b/rules/windows/execution_windows_script_from_internet.toml
index 828b9b149c2..c1e7c473302 100644
--- a/rules/windows/execution_windows_script_from_internet.toml
+++ b/rules/windows/execution_windows_script_from_internet.toml
@@ -2,9 +2,9 @@
 creation_date = "2025/01/31"
 integration = ["endpoint"]
 maturity = "production"
-min_stack_comments = "Mark of The Web enrichment was added to Elastic Defend file events in 8.15.0."
-min_stack_version = "8.15.0"
-updated_date = "2025/02/14"
+updated_date = "2025/04/23"
+min_stack_version = "9.0.0"
+min_stack_comments = "The fields file.origin_referrer_url and file.origin_url were introduced in ECS as of version 9.0.0"
 
 [rule]
 author = ["Elastic"]