diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log
new file mode 100644
index 00000000..cfb47b95
--- /dev/null
+++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6a34a838e00a382bb6212fffb73244232a2006013e1422c4541f5298271e9f62
+size 2616
diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml
new file mode 100644
index 00000000..cc301428
--- /dev/null
+++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml
@@ -0,0 +1,13 @@
+author: vahid malekmohammadi
+id: 7d709b3d-ed24-4b8d-ac67-6233b2c3adfa
+date: '2026-10-26'
+description: Generated dataset for linux auditd cross-process ptrace (PTRACE_SEIZE) in attack range. A tracer (strace) attaches to a running process via ptrace, producing SYSCALL (syscall=ptrace), OBJ_PID and PROCTITLE records keyed as tracing.
+environment: attack_range
+directory: linux_auditd_ptrace
+mitre_technique:
+- T1055.008
+datasets:
+- name: linux_auditd_ptrace
+  path: /datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log
+  sourcetype: auditd
+  source: auditd