diff --git a/rules/windows/process_creation/win_powershell_bitsjob.yaml b/rules/windows/process_creation/win_powershell_bitsjob.yaml
index 2eb6db523..1bbba2098 100644
--- a/rules/windows/process_creation/win_powershell_bitsjob.yaml
+++ b/rules/windows/process_creation/win_powershell_bitsjob.yaml
@@ -1,10 +1,12 @@
 title: Suspicious Bitsadmin Job via PowerShell
 status: experimental
-description: Detect download of BITS jobs via PowerShell.
+description: Detect download by BITS jobs via PowerShell
 references:
     - https://eqllib.readthedocs.io/en/latest/analytics/ec5180c9-721a-460f-bddc-27539a284273.html
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
 author: Endgame, JHasenbusch (ported to sigma for oscd.community)
-date: 2018/30/11
+date: 2018/10/30
+modified: 2019/11/11
 tags:
     - attack.defense_evasion
     - attack.persistence
@@ -14,7 +16,8 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine: '*powershell.exe *Start-BitsTransfer*'
+        Image|endswith: '\powershell.exe'
+        CommandLine|contains: 'Start-BitsTransfer'
     condition: selection
 falsepositives:
     - Unknown