MITRE ATT&CK Coverage — Threadlinqs Intelligence
MITRE ATT&CK is the industry catalogue of adversary tactics and techniques. This page maps the Threadlinqs corpus onto it: for every tactic, how many distinct techniques the corpus documents and how many profiled threats use them, each linked to deployable Splunk SPL, Microsoft KQL and Sigma detections.
Data as of : 788 MITRE ATT&CK techniques plus 38 MITRE ATLAS (adversarial-ML) techniques observed across the corpus, 826 distinct techniques in total. Tactic labels are normalised across the Enterprise, ICS, Mobile and ATLAS matrices, so each tactic is counted once.
| Tactic | Techniques | Threats |
|---|---|---|
| Defense Evasion | 168 | 2,032 |
| Persistence | 94 | 1,703 |
| Collection | 68 | 1,806 |
| Credential Access | 65 | 1,762 |
| Execution | 61 | 2,007 |
| Impact | 61 | 1,394 |
| Discovery | 59 | 1,840 |
| Initial Access | 56 | 2,128 |
| Command and Control | 56 | 1,799 |
| Privilege Escalation | 56 | 988 |
| Resource Development | 49 | 1,552 |
| Reconnaissance | 40 | 924 |
| Lateral Movement | 27 | 940 |
| Exfiltration | 26 | 1,369 |
| Inhibit Response Function (ICS) | 12 | 12 |
| Impact (ICS) | 6 | 2 |
| Impair Process Control (ICS) | 5 | 9 |
| Evasion (ICS) | 5 | 6 |
| AI Attack Staging (ATLAS) | 4 | 5 |
| AI Model Access (ATLAS) | 2 | 5 |
| Impact (ATLAS) | 2 | 2 |
| Initial Access (ICS) | 2 | 2 |
| Lateral Movement (ICS) | 2 | 2 |
| Collection (Mobile) | 2 | 1 |
| Command and Control (Mobile) | 1 | 1 |
| Defense Evasion (ATLAS) | 1 | 1 |
| Discovery (ICS) | 1 | 1 |
| Discovery (Mobile) | 1 | 1 |
| Execution (ICS) | 1 | 1 |
| Initial Access (Mobile) | 1 | 1 |
| Network Effects (Mobile) | 1 | 1 |
| Persistence (ATLAS) | 1 | 1 |
| Persistence (ICS) | 1 | 1 |
| Unmapped / non-ATT&CK | 92 | 1,256 |
What this coverage means
The deepest technique coverage sits in Defense Evasion, Persistence, Collection — the tactics where the corpus documents the most distinct adversary behaviours.
By breadth of threats affected the order changes: Initial Access, Defense Evasion, Execution appear on more profiled threats than any other tactic.
The widest divergence between the two is Initial Access: 56 distinct techniques, ranking 8 by technique depth, yet 2,128 threats, ranking 1 by breadth — a small technique set that recurs across a large share of the corpus.
Interactive matrix with per-technique detections in the app. Gap analysis and technique prediction via the MCP server. Corpus-wide counts: platform statistics.