MITRE ATT&CK Coverage — Threadlinqs Intelligence

MITRE ATT&CK is the industry catalogue of adversary tactics and techniques. This page maps the Threadlinqs corpus onto it: for every tactic, how many distinct techniques the corpus documents and how many profiled threats use them, each linked to deployable Splunk SPL, Microsoft KQL and Sigma detections.

Data as of 2026-10-27: 820 MITRE ATT&CK techniques plus 45 MITRE ATLAS (adversarial-ML) techniques observed across the corpus, 865 distinct techniques in total. Tactic labels are normalised across the Enterprise, ICS, Mobile and ATLAS matrices, so each tactic is counted once.

What this coverage means

The deepest technique coverage sits in Stealth (formerly Defense Evasion), Persistence, Credential Access — the tactics where the corpus documents the most distinct adversary behaviours.

By breadth of threats affected the order changes: Initial Access, Execution, Stealth (formerly Defense Evasion) appear on more profiled threats than any other tactic.

The widest divergence between the two is Privilege Escalation (Mobile): 3 distinct techniques, ranking 39 by technique depth, yet 40 threats, ranking 23 by breadth — a small technique set that recurs across a large share of the corpus.

Interactive matrix with per-technique detections in the app. Gap analysis and technique prediction via the MCP server. Corpus-wide counts: platform statistics.