diff --git a/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log b/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log
new file mode 100644
index 00000000..73076859
--- /dev/null
+++ b/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f363825665776d98e8d4b3f0b411ab7159cd514001234b807e77a765faa5fdc8
+size 2026
diff --git a/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.yml b/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.yml
new file mode 100644
index 00000000..a70e1f8b
--- /dev/null
+++ b/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.yml
@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: e5ca1036-55eb-47cf-94e0-408ee2cbc36a
+date: '2025-09-30'
+description: Generated datasets for renamed LOLBAS binary in attack range.
+environment: attack_range
+directory: renamed_lolbas_binary
+mitre_technique:
+- T1036.003
+datasets:
+- name: renamed_lolbas_binary
+  path: /datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log b/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log
new file mode 100644
index 00000000..b0e44f89
--- /dev/null
+++ b/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:395c1f40e133387948764f22f780c0c32b81a7abbdb6d0573e48e4b7de855936
+size 4392
diff --git a/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.yml b/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.yml
new file mode 100644
index 00000000..5e876bb1
--- /dev/null
+++ b/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.yml
@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 8e8c43db-3671-4264-996b-5a35b58204f7
+date: '2025-09-30'
+description: Generated datasets for Windows Defender intermediary artifacts in attack range.
+environment: attack_range
+directory: shieldcrash_windefender_artifacts
+mitre_technique:
+- T1068
+datasets:
+- name: shieldcrash_windefender_artifacts
+  path: /datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file