Update AU technique wording.

DataDog · Feb 19, 2025 · 04f3cd6 · 04f3cd6
1 parent da1a353
commit 04f3cd6
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/docs/attack-techniques/entra-id/entra-id.persistence.hidden-au.md b/docs/attack-techniques/entra-id/entra-id.persistence.hidden-au.md
@@ -17,8 +17,7 @@ Platform: Entra ID
 ## Description
 
 
-Creates an [Administrative Unit (AU)](https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0) with hidden membership, and a scoped role assignment over this AU.
-This simulates an attacker that TODO.
+Creates an [Administrative Unit (AU)](https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0) with hidden membership, and a scoped role assignment over this AU. This simulates an attacker attempting to conceal the scope of a scoped role assignment using hidden AU membership.
 
 <span style="font-variant: small-caps;">Warm-up</span>:
 

diff --git a/docs/attack-techniques/entra-id/entra-id.persistence.restricted-au.md b/docs/attack-techniques/entra-id/entra-id.persistence.restricted-au.md
@@ -17,7 +17,7 @@ Platform: Entra ID
 ## Description
 
 
-Creates a [restricted management Administrative Unit (AU)](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management), and place a backdoor account in it to simulate a protected attacker-controlled user.
+Creates a [restricted management Administrative Unit (AU)](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management), and places a backdoor account in it to simulate a protected attacker-controlled user.
 
 <span style="font-variant: small-caps;">Warm-up</span>: