diff --git a/datasets/attack_techniques/T1068/vghost/audit.log b/datasets/attack_techniques/T1068/vghost/audit.log
new file mode 100644
index 00000000..93c87406
--- /dev/null
+++ b/datasets/attack_techniques/T1068/vghost/audit.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:be13d4937c73e045cd5732c575eb5da5ad86e41eb9846e4ff42b67370075a844
+size 4586
diff --git a/datasets/attack_techniques/T1068/vghost/sysmon.log b/datasets/attack_techniques/T1068/vghost/sysmon.log
new file mode 100644
index 00000000..11c9c696
--- /dev/null
+++ b/datasets/attack_techniques/T1068/vghost/sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a725b85eab67591a650e8b0e27dd157aa965e7e02e7a879a2707b943265d3632
+size 88618
diff --git a/datasets/attack_techniques/T1068/vghost/vghost.yml b/datasets/attack_techniques/T1068/vghost/vghost.yml
new file mode 100644
index 00000000..63774eb6
--- /dev/null
+++ b/datasets/attack_techniques/T1068/vghost/vghost.yml
@@ -0,0 +1,18 @@
+author: Ryan Tait, Splunk
+id: 7d3f4821-b6c5-4e8a-9d2f-1a5e6c8b0f34
+date: '2026-10-19'
+description: Generated datasets for CVE-2026-74580 privilege escalation in attack range.
+environment: attack_range
+directory: vghost
+mitre_technique:
+- T1068
+- T1027.004
+datasets:
+-   name: audit
+    sourcetype: auditd
+    source: auditd
+    path: /datasets/attack_techniques/T1068/vghost/audit.log
+-   name: sysmon
+    sourcetype: syslog
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1068/vghost/sysmon.log