diff --git a/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.log b/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.log
new file mode 100644
index 00000000..942a48a4
--- /dev/null
+++ b/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:621fefb35d002eeab9143d4aab0207ddb0908fb71be99be9d18b382659b19271
+size 984
diff --git a/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.yml b/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.yml
new file mode 100644
index 00000000..32c7ff96
--- /dev/null
+++ b/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.yml
@@ -0,0 +1,12 @@
+author: Nasreddine Bencherchali
+id: 594e402a-dcab-4608-bcbf-7cd7c1a19391
+date: '2026-07-01'
+description: Sample events containing emails files being created outside of common directories
+environment: custom
+mitre_technique:
+- T1114.001
+datasets:
+- name: emails_outside_dir_sysmon
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  path: /datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.log