From dd1a0e764ce4e5c1d77c80e4a4835d6f0ca97080 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@bsk-consulting.de>
Date: Tue, 25 Feb 2020 11:13:58 +0100
Subject: [PATCH] docs: more false positive conditions

---
 .../windows/powershell/powershell_alternate_powershell_hosts.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/windows/powershell/powershell_alternate_powershell_hosts.yml b/rules/windows/powershell/powershell_alternate_powershell_hosts.yml
index 0feb2c68b..37f108274 100644
--- a/rules/windows/powershell/powershell_alternate_powershell_hosts.yml
+++ b/rules/windows/powershell/powershell_alternate_powershell_hosts.yml
@@ -28,4 +28,5 @@ detection:
 falsepositives:
     - Programs using PowerShell directly without invocation of a dedicated interpreter
     - MSP Detection Searcher
+    - Citrix ConfigSync.ps1
 level: medium