fix: FPs noticed in THOR testing

rules/windows/powershell/powershell_script/posh_ps_suspicious_invocation_specific.yml

@@ -10,7 +10,7 @@ tags:
     - attack.t1059.001
 author: Florian Roth (rule), Jonhnathan Ribeiro
 date: 2017/03/05
-modified: 2022/02/16
+modified: 2022/02/21
 logsource:
     product: windows
     category: ps_script
@@ -64,6 +64,7 @@ detection:
         ScriptBlockText|contains:
             - "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
             - "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
+            - 'Write-ChocolateyWarning'
     condition: 1 of select* and not 1 of filter*
 falsepositives:
     - Penetration tests