diff --git a/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail.json
new file mode 100644
index 00000000..634c4f1d
--- /dev/null
+++ b/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail.json
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6f0da07d2d6d9297a55b1754ce9f65a624c84fa774dc008a9b47622aca5cc3ad
+size 2646
diff --git a/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail.json
new file mode 100644
index 00000000..1258fbf9
--- /dev/null
+++ b/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail.json
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b49986b2be8a363c5f3835b1d7f0d2de5a3536c7ba4d26ef7f46f5eef6fa2559
+size 2271
diff --git a/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail.json
new file mode 100644
index 00000000..c4aedff3
--- /dev/null
+++ b/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail.json
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:bd943aeea797035118794289394ca36d53e150fb37e3db620f7ffb3b937be7fe
+size 2443