Update AU documentation wording

DataDog · Feb 19, 2025 · 8b735b3 · 8b735b3
1 parent 04f3cd6
commit 8b735b3
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/v2/internal/attacktechniques/entra-id/persistence/hidden-au/main.go b/v2/internal/attacktechniques/entra-id/persistence/hidden-au/main.go
@@ -21,8 +21,7 @@ func init() {
 		ID:           "entra-id.persistence.hidden-au",
 		FriendlyName: "Create Hidden Scoped Role Assignment Through HiddenMembership AU",
 		Description: `
-Creates an [Administrative Unit (AU)](https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0) with hidden membership, and a scoped role assignment over this AU.
-This simulates an attacker that TODO.
+Creates an [Administrative Unit (AU)](https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0) with hidden membership, and a scoped role assignment over this AU. This simulates an attacker attempting to conceal the scope of a scoped role assignment using hidden AU membership.
 
 Warm-up:
 

diff --git a/v2/internal/attacktechniques/entra-id/persistence/restricted-au/main.go b/v2/internal/attacktechniques/entra-id/persistence/restricted-au/main.go
@@ -21,7 +21,7 @@ func init() {
 		ID:           "entra-id.persistence.restricted-au",
 		FriendlyName: "Create Sticky Backdoor User Through Restricted Management AU",
 		Description: `
-Creates a [restricted management Administrative Unit (AU)](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management), and place a backdoor account in it to simulate a protected attacker-controlled user.
+Creates a [restricted management Administrative Unit (AU)](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management), and places a backdoor account in it to simulate a protected attacker-controlled user.
 
 Warm-up: