BITS Transfer Job Download To Potential Suspicious Folder — Detection Rule
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location