diff --git a/datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml b/datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml
new file mode 100644
index 000000000..37d851dfb
--- /dev/null
+++ b/datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: d65ac1ca-85be-4a33-82d0-944222f374b6
+date: '2026-09-23'
+description: Manual exploitation of CVE-2026-27912 using a public exploit.
+environment: attack_range
+directory: resetnightmare
+mitre_technique:
+- T1078.002
+datasets:
+-   name: windows-xml
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Security
+    path: /datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log
diff --git a/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log b/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log
new file mode 100644
index 000000000..82624e9b0
--- /dev/null
+++ b/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:bcc0c1da4dbb79b04e5e905a854226ad33ab050e3480589317c0d0c37189aab4
+size 1714