diff --git a/communication/http/client/create-bits-job.yml b/communication/http/client/create-bits-job.yml
index 7fe6a26c..f9edc049 100644
--- a/communication/http/client/create-bits-job.yml
+++ b/communication/http/client/create-bits-job.yml
@@ -6,6 +6,9 @@ rule:
     author: "@mr-tz"
     description: BITS jobs can be used to download data or achieve persistence (via SetNotifyCmdLine)
     scope: function
+    att&ck:
+      - Defense Evasion::BITS Jobs [T1197]
+      - Persistence::BITS Jobs [T1197]
     references:
       - https://www.fireeye.com/blog/threat-research/2021/03/attacker-use-of-windows-background-intelligent-transfer-service.html
     examples: