From 70f2af8563ad7ac4099709d5d87a77efbe28b56e Mon Sep 17 00:00:00 2001
From: Ryan Xu <ryanxu@wustl.edu>
Date: Mon, 23 Aug 2021 10:55:20 -0500
Subject: [PATCH] Update create-bits-job.yml

---
 communication/http/client/create-bits-job.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/communication/http/client/create-bits-job.yml b/communication/http/client/create-bits-job.yml
index 7fe6a26c..f9edc049 100644
--- a/communication/http/client/create-bits-job.yml
+++ b/communication/http/client/create-bits-job.yml
@@ -6,6 +6,9 @@ rule:
     author: "@mr-tz"
     description: BITS jobs can be used to download data or achieve persistence (via SetNotifyCmdLine)
     scope: function
+    att&ck:
+      - Defense Evasion::BITS Jobs [T1197]
+      - Persistence::BITS Jobs [T1197]
     references:
       - https://www.fireeye.com/blog/threat-research/2021/03/attacker-use-of-windows-background-intelligent-transfer-service.html
     examples: