diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log
new file mode 100644
index 000000000..00867d2b7
--- /dev/null
+++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4d990849f651dea10df286d51673b1d09dc536b03a82df3f9e113b4e8c9ce13c
+size 1069
diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml
new file mode 100644
index 000000000..746ca46ea
--- /dev/null
+++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml
@@ -0,0 +1,13 @@
+author: Maria Jose Erquiaga
+id: 436d5044-ae22-475d-9e19-dfc8a2f4e94f
+date: '2026-09-02'
+description: Generated datasets for Cisco Network Visibility Module Flow Data EventType.
+environment: custom
+directory: macos_browser_spawned_script_external_network_connection
+mitre_technique:
+    - T1059
+datasets:
+    - name: nvm_flowdata
+      sourcetype: cisco:nvm:flowdata:v2
+      source: not_applicable
+      path: /datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log
diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json
new file mode 100644
index 000000000..17726c40b
--- /dev/null
+++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2bfe4a3caa9c5fbd12515328f0c2c842f4dc939179f3102e8c04f9c88737429e
+size 1145400
diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml
new file mode 100644
index 000000000..c306b5188
--- /dev/null
+++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml
@@ -0,0 +1,16 @@
+author: Maria Jose Erquiaga
+id: 64a58b0f-ef34-44e6-bda0-f10457e9cbc0
+date: '2026-09-21'
+description: >-
+  Dataset containing AWS CloudTrail events generated by more than 500 Amazon
+  CloudWatch Logs GetLogEvents operations performed by the same principal and
+  AWS account within a five-minute period.
+environment: attack_range
+directory: aws_cloudwatch_logs_high_volume_retrieval
+mitre_technique:
+  - T1530
+datasets:
+  - name: aws_cloudwatch_logs_high_volume_retrieval-json
+    path: /datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail