fix: FPs noticed in CI testing

rules/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml

@@ -9,6 +9,7 @@ references:
     - https://github.com/danielbohannon/Invoke-Obfuscation
 author: frack113
 date: 2022/12/27
+modified: 2023/01/03
 tags:
     - attack.defense_evasion
     - attack.t1027.009
@@ -25,8 +26,10 @@ detection:
         #   ${e`Nv:pATh}
         - ScriptBlockText|re: '\w+\`(\w+|-|.)\`[\w+|\s]'
         #- ScriptBlockText|re: '\((\'(\w|-|\.)+\'\+)+\'(\w|-|\.)+\'\)' TODO: fixme
-        - ScriptBlockText|re: '"({\d})+"\s*-f'
-        - ScriptBlockText|re: '\${((e|n|v)*`(e|n|v)*)+:path}|\${((e|n|v)*`(e|n|v)*)+:((p|a|t|h)*`(p|a|t|h)*)+}|\${env:((p|a|t|h)*`(p|a|t|h)*)+}'
+        - ScriptBlockText|re: '"(\{\d\})+"\s*-f'
+        - ScriptBlockText|re: '\$\{((e|n|v)*`(e|n|v)*)+:path\}|\$\{((e|n|v)*`(e|n|v)*)+:((p|a|t|h)*`(p|a|t|h)*)+\}|\$\{env:((p|a|t|h)*`(p|a|t|h)*)+\}'
+    filter:
+        - ScriptBlockText|contains: 'it will return true or false instead'  # Chocolatey install script https://github.com/chocolatey/chocolatey
     condition: selection
 falsepositives:
     - Unknown