Updated rules

rules/BitsClientOperational/59_T1197_BitsJobCreation.yaml

@@ -0,0 +1,18 @@
+title: Bits Job Creation
+title_jp: Bits Jobの作成
+description: Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
+description_jp: Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
+author: James Takai, itiB
+contributor: Zach Mathis 
+mitre_attack: T1197
+level: medium
+detection:
+    selection:
+        Channel: Microsoft-Windows-Bits-Client/Operational
+        EventID: 59
+falsepositives:
+    - normal system usage
+output: 'Job Title:%JobTitle% URL:%Url%'
+output_jp: 'Job名:%JobTitle% URL:%Url%'
+creation_date: 2021/07/15
+updated_date:  2021/11/06