diff --git a/datasets/attack_techniques/T1068/linux_pedit/linux_auditd.log b/datasets/attack_techniques/T1068/linux_pedit/linux_auditd.log
new file mode 100644
index 00000000..5846ffb5
--- /dev/null
+++ b/datasets/attack_techniques/T1068/linux_pedit/linux_auditd.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:157ce9fb84cff672a094a5d976535a4ab369e3f05a7dbcf98a7b69c17f08c2c9
+size 307
diff --git a/datasets/attack_techniques/T1068/linux_pedit/linux_pedit.yml b/datasets/attack_techniques/T1068/linux_pedit/linux_pedit.yml
new file mode 100644
index 00000000..c4bb8d7b
--- /dev/null
+++ b/datasets/attack_techniques/T1068/linux_pedit/linux_pedit.yml
@@ -0,0 +1,22 @@
+author: Raven Tait, Splunk
+id: c94e56b2-9e11-4d15-9c46-ae6ca9b3bc80
+date: '2026-07-06'
+description: Generated datasets for CVE-2026-46331 privilege escalation
+    in attack range.
+environment: attack_range
+directory: linux_pedit
+mitre_technique:
+- T1068
+datasets:
+-   name: linux_sysmon
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1068/linux_pedit/sysmon_linux.log
+-   name: syslog
+    sourcetype: linux_messages_syslog
+    source: /var/log/syslog
+    path: /datasets/attack_techniques/T1068/linux_pedit/syslog.log
+-   name: audit
+    sourcetype: auditd
+    source: auditd
+    path: /datasets/attack_techniques/T1068/linux_pedit/linux_auditd.log
\ No newline at end of file
diff --git a/datasets/attack_techniques/T1068/linux_pedit/syslog.log b/datasets/attack_techniques/T1068/linux_pedit/syslog.log
new file mode 100644
index 00000000..b394a102
--- /dev/null
+++ b/datasets/attack_techniques/T1068/linux_pedit/syslog.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7400967eb976e2facc45314db7754b224ed8cecc9eb0b503e14242aebd2ebafc
+size 196
diff --git a/datasets/attack_techniques/T1068/linux_pedit/sysmon_linux.log b/datasets/attack_techniques/T1068/linux_pedit/sysmon_linux.log
new file mode 100644
index 00000000..0a0b7698
--- /dev/null
+++ b/datasets/attack_techniques/T1068/linux_pedit/sysmon_linux.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d258c995d79098be6fafefc6a5fcc9220b7bae11bf8256427591f60c1f817af7
+size 1684