diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml
index 363f2c0204..9c5974b9c2 100644
--- a/detections/cloud/azure_automation_runbook_created.yml
+++ b/detections/cloud/azure_automation_runbook_created.yml
@@ -36,7 +36,7 @@ tags:
   - Source:Cloud Data
   - Stage:Persistence
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques//T1078.004/azure_automation_runbook/azure-activity.log
   impact: 70
   kill_chain_phases:
   - Installation
diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml
index 6bf2fe345b..ba804d57b1 100644
--- a/detections/cloud/azure_runbook_webhook_created.yml
+++ b/detections/cloud/azure_runbook_webhook_created.yml
@@ -5,7 +5,11 @@ date: '2022-08-23'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: UPDATE_DESCRIPTION
+description: The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows
+  administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python.
+  One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet.
+  An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM.
+  This provides a persistent foothold on the environment.
 search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded
   | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
   | `azure_runbook_webhook_created_filter`'
diff --git a/tests/cloud/azure_automation_runbook_created.test.yml b/tests/cloud/azure_automation_runbook_created.test.yml
index e9a5a853fe..f290007034 100644
--- a/tests/cloud/azure_automation_runbook_created.test.yml
+++ b/tests/cloud/azure_automation_runbook_created.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   attack_data:
   - file_name: azure-activity.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity.log
     source: mscs:azure:audit
     sourcetype: mscs:azure:audit
     update_timestamp: true