diff --git a/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log b/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log
new file mode 100644
index 000000000..d37682d73
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d8d079236fe6f0c17783e309735d2368a0b3d6751840e1b453569be594cfc70c
+size 1132
diff --git a/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log b/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log
new file mode 100644
index 000000000..75d5f0a43
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f88ca718b81e5971cec4865a692df4bb3cb71263c71f26bd91ab3cd44e7f6bf1
+size 5698
diff --git a/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log b/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log
new file mode 100644
index 000000000..90a87c2de
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:41d280e80b304f6fa0a52cccd39f3d6fe53e448b9822d27b2ac2efb2a7661e23
+size 1619
diff --git a/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log b/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log
new file mode 100644
index 000000000..c167f0548
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f88debe62e622cb82760960ae80be0574c29489371d87821bd821c82fc0c5eaa
+size 993
diff --git a/datasets/emerging_threats/ShieldBreak/shieldbreak.yml b/datasets/emerging_threats/ShieldBreak/shieldbreak.yml
new file mode 100644
index 000000000..ea5dc133a
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/shieldbreak.yml
@@ -0,0 +1,39 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 747ebcb7-b67c-4cdd-9409-320afb430187
+date: '2026-08-17'
+description: Generated datasets for ShieldBreak exploitation targeting Windows Defender. Includes various scenarios in order to detect ShieldBreak exploitation attempts.
+environment: NA
+directory: shieldbreak
+mitre_technique:
+- T1068
+- T1134.001
+- T1053.005
+- T1574.001
+- T1211
+- T1564.004
+- T1021.002
+datasets:
+- name: system_integrity_process.log
+  path: /datasets/emerging_threats/shieldbreak/system_integrity_process.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: wer_file_creation.log
+  path: /datasets/emerging_threats/shieldbreak/wer_file_creation.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: phoneinfo_dll_created.log
+  path: /datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: mpclient_dll_loaded.log
+  path: /datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: defender_kernel_object.log
+  path: /datasets/emerging_threats/shieldbreak/defender_kernel_object.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational
+- name: ads_over_local_share.log
+  path: /datasets/emerging_threats/shieldbreak/ads_over_local_share.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/datasets/emerging_threats/ShieldBreak/system_integrity_process.log b/datasets/emerging_threats/ShieldBreak/system_integrity_process.log
new file mode 100644
index 000000000..654609161
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/system_integrity_process.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2643e30817ebf2a9246dbed07b4a14782a0ae4d5ee3f52d170aadb9060b94697
+size 1960
diff --git a/datasets/emerging_threats/ShieldBreak/wer_file_creation.log b/datasets/emerging_threats/ShieldBreak/wer_file_creation.log
new file mode 100644
index 000000000..9793d2bf9
--- /dev/null
+++ b/datasets/emerging_threats/ShieldBreak/wer_file_creation.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:464af16d37e3ba0fb36fddb332e4126402dc3671354e7bf2cb0a4fd55274a8ce
+size 1137