Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. This rule is adapted from _client/win_bits_client_new_transfer_via_uncommon_tld.yml