TTP Tactics, Techniques & Procedures

What is TTP?

The behavioral fingerprint of a threat actor. More durable than IOCs because adversaries reuse TTPs even when their malware changes. MITRE ATT&CK is the canonical TTP framework.

The three words are three levels of abstraction. A tactic is what the adversary is trying to achieve at that moment, such as gaining initial access or escalating privilege. A technique is the method used to get there, such as spearphishing an attachment or abusing a valid account. A procedure is the specific implementation, down to the exact command line a particular group habitually runs.

TTPs matter because they are expensive to change. A file hash changes with every recompile and a command-and-control domain can be rotated in minutes, but the underlying method reflects an adversary’s tooling, training and habit. This is the top of David Bianco’s Pyramid of Pain: block a hash and you inconvenience an attacker for an afternoon, detect a technique and you force them to rebuild how they operate.

The practical consequence is detection lifespan. A rule that fires on one malicious DLL stops working the moment that DLL is rebuilt. A rule that fires on the behavior of one process injecting into another keeps working across whole malware families. Vijilan’s SOC maps every detection to MITRE ATT&CK, so the coverage question becomes which adversary behaviors are being watched rather than how many signatures are loaded.

Common questions

What does TTP stand for in cyber security?

TTP stands for tactics, techniques and procedures. It describes the behavior of a threat actor at three levels of detail: the goal they are pursuing, the method they use, and the specific way they carry it out. The term comes from military doctrine and was adopted by threat intelligence because behavior identifies an adversary more reliably than their tooling does.

What is the difference between TTPs and IOCs?

An indicator of compromise is an artifact, such as a file hash, IP address or domain, that shows a known threat was present. A TTP is the behavior that produced it. Indicators are precise but perishable, because an attacker invalidates them by recompiling a binary or moving to a new domain. TTPs are fuzzier to detect but far more durable, which is why mature detection programmes use indicators for speed and TTPs for coverage.

Why are TTPs harder for an attacker to change?

Because they are habits rather than artifacts. Changing a hash takes one build. Changing the way your team establishes persistence, moves laterally and exfiltrates data means retraining people and rewriting tooling, and the replacement behavior is usually still recognizable. That asymmetry is the reason behavior-based detection is worth the extra engineering it demands.