Patterns & prevention

If you can only do a few things, do the ones that cover the most. These are ranked by breadth — how many of the 657 catalogued attacks a single telemetry source or mitigation touches, and across how many of the 10 categories. A control that spans many categories is a real choke point, not a point fix.

Collect once, see many

The one log source that, if you collect it, gives you visibility into the most attacks. Straight from each attack's ATT&CK data components.

Each dot is one telemetry source. Up = it spans more of the 10 categories; right = it touches more attacks. The top-right corner is where a single log source is a real choke point, not a point fix.

#	Telemetry source (ATT&CK data component)	Attacks covered	Categories	For example
1	Process Creation	207 / 657	10 / 10	Abused legitimate remote-access tools, ACK flood, Adversary-in-the-middle phishing kits, AI-agent-assisted cybercrime operations (BUGSTER case study), AI coding-assistant config / key theft
2	Application Log Content	151 / 657	10 / 10	AD CS ACL / CA misconfiguration (ESC4–ESC7), AD CS mapping / policy abuse (ESC9–ESC16), AD CS relay (ESC8/ESC11), AD CS template abuse (ESC1–ESC3), Adversary-in-the-middle (AitM/MITM)
3	Network Traffic Content	139 / 657	10 / 10	Accidental cloud disclosure, AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, Alarm suppression
4	Network Connection Creation	121 / 657	9 / 10	Abused legitimate remote-access tools, ACK flood, AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits
5	Network Traffic Flow	120 / 657	10 / 10	ACK flood, AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, AI-agent-assisted cybercrime operations (BUGSTER case study)
6	File Creation	105 / 657	10 / 10	Abused legitimate remote-access tools, AI coding-assistant config / key theft, AI-generated / polymorphic malware, Angler phishing, API key / secret leakage
7	Command Execution	83 / 657	9 / 10	AD CS ACL / CA misconfiguration (ESC4–ESC7), AD CS mapping / policy abuse (ESC9–ESC16), AD CS relay (ESC8/ESC11), AD CS template abuse (ESC1–ESC3), AI coding-assistant config / key theft
8	Logon Session Creation	67 / 657	10 / 10	Account takeover (ATO), Adversary-in-the-middle phishing kits, AI coding-assistant config / key theft, Banking trojan, BEC: account compromise
9	File Modification	62 / 657	10 / 10	AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, AI-generated / polymorphic malware, Baiting
10	User Account Authentication	57 / 657	10 / 10	Accidental cloud disclosure, Account takeover (ATO), Adversary-in-the-middle phishing kits, AI-agent-assisted cybercrime operations (BUGSTER case study), API key / secret leakage
11	Process Access	56 / 657	9 / 10	Adversary-in-the-middle phishing kits, AI-generated / polymorphic malware, Application-layer (L7) DDoS, Banking trojan, Bring-your-own-vulnerable-driver (BYOVD)
12	File Access	53 / 657	10 / 10	AD CS ACL / CA misconfiguration (ESC4–ESC7), AD CS mapping / policy abuse (ESC9–ESC16), AD CS relay (ESC8/ESC11), AD CS template abuse (ESC1–ESC3), Adversary-in-the-middle phishing kits
13	Module Load	44 / 657	8 / 10	AI-generated / polymorphic malware, BadUSB / USB drop, BadUSB / USB Rubber Ducky, Banking trojan, Bring-your-own-vulnerable-driver (BYOVD)
14	Windows Registry Key Modification	43 / 657	7 / 10	AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, API key / secret leakage, Bring-your-own-vulnerable-driver (BYOVD)
15	Host Status	38 / 657	6 / 10	ACK flood, Application-layer (L7) DDoS, Baseband exploitation, BlackNurse, Bring-your-own-vulnerable-driver (BYOVD)

Deploy once, cover many

The one mitigation linked as a defence for the most attacks. The category spread is the tell: a control that reaches across the taxonomy is leverage, not a niche fix.

#	Mitigation (ATT&CK)	Attacks covered	Categories	For example
1	`M1037` Filter Network Traffic	84 / 657	8 / 10	Abused legitimate remote-access tools, Accidental cloud disclosure, ACK flood, AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM)
2	`M1017` User Training	82 / 657	10 / 10	Account takeover (ATO), AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, AI coding-assistant config / key theft
3	`M1018` User Account Management	82 / 657	10 / 10	Accidental cloud disclosure, Account takeover (ATO), Add cloud credentials / roles, Angler phishing, Banking trojan
4	`M1047` Audit	73 / 657	9 / 10	Accidental cloud disclosure, AD CS ACL / CA misconfiguration (ESC4–ESC7), AD CS mapping / policy abuse (ESC9–ESC16), AD CS relay (ESC8/ESC11), AD CS template abuse (ESC1–ESC3)
5	`M1026` Privileged Account Management	73 / 657	8 / 10	Account takeover (ATO), Add cloud credentials / roles, API key / secret leakage, AWS SSM Agent hybrid activation abuse as a covert remote-access channel, Bootkit
6	`M1051` Update Software	63 / 657	8 / 10	Adversary-in-the-middle phishing kits, API key / secret leakage, Bring-your-own-vulnerable-driver (BYOVD), Browser hijacker, Brute force / password guessing
7	`M1042` Disable or Remove Feature or Program	53 / 657	8 / 10	Abused legitimate remote-access tools, AD CS ACL / CA misconfiguration (ESC4–ESC7), AD CS mapping / policy abuse (ESC9–ESC16), AD CS relay (ESC8/ESC11), AD CS template abuse (ESC1–ESC3)
8	`M1032` Multi-factor Authentication	51 / 657	10 / 10	Accidental cloud disclosure, Account takeover (ATO), Add cloud credentials / roles, Adversary-in-the-middle phishing kits, AI-agent-assisted cybercrime operations (BUGSTER case study)
9	`M1027` Password Policies	47 / 657	9 / 10	Account takeover (ATO), AI-agent-assisted cybercrime operations (BUGSTER case study), AI coding-assistant config / key theft, API key / secret leakage, AS-REP roasting
10	`M1030` Network Segmentation	47 / 657	8 / 10	AD CS relay (ESC8/ESC11), Add cloud credentials / roles, Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, Build image on host
11	`M1031` Network Intrusion Prevention	42 / 657	8 / 10	AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, ARP spoofing / poisoning, Automated / scheduled / size-limited exfiltration
12	`M1035` Limit Access to Resource Over Network	40 / 657	8 / 10	AD CS relay (ESC8/ESC11), Adversary-in-the-middle (AitM/MITM), Adversary-in-the-middle phishing kits, API key / secret leakage, ARP spoofing / poisoning
13	`M1041` Encrypt Sensitive Information	40 / 657	7 / 10	Accidental cloud disclosure, AD CS ACL / CA misconfiguration (ESC4–ESC7), AD CS mapping / policy abuse (ESC9–ESC16), AD CS relay (ESC8/ESC11), AD CS template abuse (ESC1–ESC3)
14	`M1021` Restrict Web-Based Content	35 / 657	6 / 10	Adversary-in-the-middle phishing kits, Angler phishing, Baiting, BEC: data theft (W-2/PII), Browser-in-the-browser (BitB)
15	`M1054` Software Configuration	34 / 657	6 / 10	Adversary-in-the-middle phishing kits, BEC: data theft (W-2/PII), Bring-your-own-vulnerable-driver (BYOVD), Browser-in-the-browser (BitB), Clone phishing

Read this honestly

Breadth, not efficacy. A mitigation linked to 80 attacks is not proven to stop any of them — it means the corpus records it as a relevant defence that often. Coverage tells you where to start, not that you are done.
Category breadth is the signal. A source or control that spans 9–10 categories is a genuine choke point; one that is common inside a single category is not.
D3FEND is excluded from the mitigation table on purpose: its artifact-to-technique mapping is coarse (several classes share identical scores), which would crowd the ranking with a mapping artifact rather than real leverage.

Generated from analysis/patterns.py over the compiled corpus — a pure, deterministic projection, regenerated and never hand-edited.