diff --git a/datasets/attack_techniques/T1621/pingid/pingid.yml b/datasets/attack_techniques/T1621/pingid/pingid.yml
index b4c902684..4310caffb 100644
--- a/datasets/attack_techniques/T1621/pingid/pingid.yml
+++ b/datasets/attack_techniques/T1621/pingid/pingid.yml
@@ -15,3 +15,11 @@ datasets:
   path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset.log
   sourcetype: XmlWinEventLog
   source: XmlWinEventLog:Security
+- name: pingid_upn_multi_reset
+  path: /datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log
+  sourcetype: _json
+  source: PINGID
+- name: windows_pw_reset_upn_multi_reset
+  path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security
diff --git a/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log b/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log
new file mode 100644
index 000000000..c46da924f
--- /dev/null
+++ b/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:88c40b8ac88a337232ef97a5abb41c9a02eaf00eab0222d5035e1992b1f71030
+size 1605
diff --git a/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log b/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log
new file mode 100644
index 000000000..b1a179066
--- /dev/null
+++ b/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:955603e9fd6db90ebea96592c2c3a2cf75039227b1120033d3a4d60ecc6df88b
+size 5728