TTPs

TTPs (Tactics, Techniques, and Procedures) describe how an attacker operates. Instead of focusing on individual traces, TTPs organize an attacker’s behavior into three levels: tactics are the goal (the “what” they want to achieve), techniques are the method (the “how” they do it), and procedures are the exact execution (the “how exactly”). This describes the lasting habits of an attacking group rather than fleeting artifacts. That is why TTPs are the most stable and hardest-to-change layer of threat knowledge. The concept is the basis of cyber threat intelligence (CTI), incident response (DFIR), and the MITRE ATT&CK framework.

What are TTPs made of?

The three levels run from the most general to the most specific:

• Tactics answer the “what”: the attacker’s goal at a given stage. Examples include getting into the network (Initial Access), staying inside it (Persistence), gaining higher privileges (Privilege Escalation), hiding from detection (Defense Evasion), and stealing data (Exfiltration).
• Techniques answer the “how”: the methods used to reach that goal. Examples include targeted phishing (spear phishing), exploiting a flaw in an internet-facing service, stealing passwords from a computer’s memory (credential dumping), or moving data out through a hidden command-and-control channel.
• Procedures answer the “how exactly”: the specific, repeatable way a given attacker carries out a technique. A procedure might be the use of a particular tool (Mimikatz, Cobalt Strike), a set of PowerShell commands, specific file names, registry keys, or the order of steps seen in real intrusions.

These levels fit together. For example: the tactic Credential Access (stealing passwords) → the technique “pull passwords from the LSASS process” → the procedure “run procdump.exe against lsass.exe, then read the dump offline, away from the victim’s system.”

How do TTPs relate to MITRE ATT&CK?

MITRE ATT&CK is a public knowledge base that records TTPs seen in real attacks and gives them shared names and identifiers. The Enterprise ATT&CK matrix lays out tactics roughly in the order of a typical attack: from reconnaissance (Reconnaissance) and resource preparation, through initial access, code execution, persistence, privilege escalation, hiding, credential theft, internal discovery, lateral movement, data collection, command-and-control, and exfiltration, all the way to the final effect (Impact).

Each tactic holds many techniques, which in turn split into sub-techniques. Together this adds up to hundreds of described behaviors, each with its own identifier (for example, T1003 for stealing operating-system credentials). This lets teams tie their detection rules to specific techniques, check how many they actually cover, and spot the gaps. It is far more effective than relying on simple signatures that are easy to bypass.

How are TTPs different from IOCs?

IOCs (Indicators of Compromise) are concrete technical traces of an attack: file hashes (checksums), IP addresses, domains, file names. TTPs describe behavior, that is how an attacker operates, rather than a single trace. The difference is practical. IOCs are easy and cheap to swap out (a new hash, a different IP), so detection built only on them ages quickly. TTPs are far harder to change, because changing them means changing the way the attacker works.

David Bianco’s Pyramid of Pain illustrates this well. It ranks types of indicators by how much “pain” it causes the attacker when you block a given level. The higher up, the more trouble the attacker has to go through:

1. Hashes — trivial to change (flip one byte of a file and you get a new hash).
2. IP addresses — easy to change (new server, VPN, proxy).
3. Domains — a bit harder, but still cheap to swap.
4. Traces on the network and the computer — e.g., distinctive headers, paths, registry keys.
5. Tools — replacing a tool costs the attacker time and money.
6. TTPs — the top of the pyramid, hardest to change because it forces a rebuild of the whole way of operating.

The takeaway for defenders is simple: detection based on TTPs causes the attacker the most pain, because it cannot be dodged by merely swapping servers or domains.

Why do TTPs matter for detection and the SOC?

In a security team (SOC) and in network monitoring (NDR/NSM), TTPs move detection from individual traces to the level of behavior. This has concrete effects:

• Behavior-based detection — rules tied to ATT&CK techniques (for example, an unusual process opening control connections) catch a whole class of activity rather than one file. Fewer false alarms, and harder to evade.
• Threat hunting (proactively hunting for threats) — you search by technique (“let’s check whether anyone is moving across the network via WMI or SMB”) instead of by a list of hashes. Network data (flows, DNS queries, metadata of encrypted traffic, regular “check-ins” to a server) reveals TTPs that the computer’s own logs may miss.
• Attribution — repeatable procedures and characteristic sets of techniques form a group’s “fingerprint.” This links a campaign to a specific attacker (for example, an APT group) more confidently than shared infrastructure, which is easy to swap.
• Measuring defensive coverage — mapping detection rules onto the ATT&CK matrix shows which tactics and techniques are watched and where the blind spots are.

How is network telemetry mapped to TTPs?

Many ATT&CK techniques leave a clear trail in network traffic, even when the computer itself logs little or is invisible to endpoint software (EDR):

• Command-and-control — connecting to a server at regular intervals, long sessions, suspicious domains, or hiding traffic inside DNS queries.
• Lateral movement — unusual SMB (port 445), RDP (3389), or WMI connections between computers that normally never talk to each other.
• Data theft — large outbound transfers, traffic that is clearly more outgoing than incoming, channels on unusual ports or through cloud services.
• Discovery — scanning inside the network, bulk DNS queries, probing for available services.

Tying these observations to ATT&CK identifiers lets you describe an incident in TTP terms and judge which stage of the attack the adversary has reached.

Learn more

• MITTRE ATT&CK — MITRE ATT&CK catalogs real-world adversary TTPs used in cyberattacks.
• Cyber Kill Chain — The Cyber Kill Chain maps attack stages where specific TTPs are used.
• Supply Chain Attack — Supply chain attacks use TTPs to compromise vendors and downstream targets.
• NIST Cybersecurity Framework — The NIST CSF helps manage risk from attacker TTPs across core functions.
• Zero-Day Exploit — Zero-day exploits are TTPs that abuse unknown vulnerabilities before fixes exist.
• Incident Response Lifecycle — Incident response uses TTPs to identify, contain, and eradicate attacks.
• Inventory — Inventory supports TTP analysis by tracking assets that attackers may target.