diff --git a/datasets/emerging_threats/sshhole/audit.log b/datasets/emerging_threats/sshhole/audit.log
new file mode 100644
index 00000000..032865a9
--- /dev/null
+++ b/datasets/emerging_threats/sshhole/audit.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7962aa93f499dd086949d992d610a28bb0dda80e73c36132e1b3a5f44b357686
+size 1087
diff --git a/datasets/emerging_threats/sshhole/sshhole.yml b/datasets/emerging_threats/sshhole/sshhole.yml
new file mode 100644
index 00000000..1738549b
--- /dev/null
+++ b/datasets/emerging_threats/sshhole/sshhole.yml
@@ -0,0 +1,17 @@
+author: Raven Tait, Splunk
+id: 3a478d9e-9c1f-4cde-a32f-c6a991b621e4
+date: '2026-11-09'
+description: Linux syslog and auditd datasets for sshhole SSH authentication bypass.
+environment: attack_range
+directory: sshhole
+mitre_technique:
+    - T1078.003
+datasets:
+    - name: syslog
+      path: /datasets/emerging_threats/sshhole/syslog.log
+      sourcetype: linux_messages_syslog
+      source: /var/log/messages
+    - name: audit
+      path: /datasets/emerging_threats/sshhole/audit.log
+      sourcetype: auditd
+      source: auditd
diff --git a/datasets/emerging_threats/sshhole/syslog.log b/datasets/emerging_threats/sshhole/syslog.log
new file mode 100644
index 00000000..8440197e
--- /dev/null
+++ b/datasets/emerging_threats/sshhole/syslog.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:61ed48173a6280af7ccf7217b7465d722477961cc456297a9ad9a480f375a0d3
+size 346