diff --git a/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml b/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml
index 6711b1abc..6a0426f14 100644
--- a/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml
+++ b/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml
@@ -23,7 +23,6 @@ detection:
             - '\rundll32.exe'
             - '\mshta.exe'
             - '\csc.exe'
-            - '\powershell.exe'
         - Image|contains:
             - 'C:\Users\Public\'
             - '\AppData\Local\Temp'