TTP (Tactics, Techniques, and Procedures)
TTPs describe the behavior of threat actors: the high-level goals they pursue (tactics), the specific methods they use to achieve those goals (techniques), and the detailed, repeatable actions that implement those methods (procedures). The MITRE ATT&CK framework catalogues TTPs used by real adversaries.
TTPs are the layer of threat intelligence that survives an infrastructure change. An indicator says which domain an actor used; a TTP says how the actor works: spear-phishing with a password-protected archive, credential dumping with a renamed system tool, exfiltration over a cloud storage API. Domains are burned in days; habits last for years.
The three words are a hierarchy. A tactic is the goal of a step (initial access, persistence, exfiltration). A technique is a way to reach it (phishing attachment, scheduled task, transfer to a cloud service). A procedure is the actor’s specific, repeatable implementation, down to the file names and command lines.
MITRE ATT&CK gives tactics and techniques a shared vocabulary and an identifier, so a report from one vendor can be compared to a detection rule from another. Procedures stay in the narrative sections of reports, because they are where actors differ from each other.
Example
Two intrusions six months apart share no indicator. Both used a signed installer trojanised with the same loader, a scheduled task named after a printer driver, and exfiltration to the same class of file-sharing service. Same TTPs, same actor, new infrastructure.
In isMalicious
isMalicious deals in the indicator layer: the domains, addresses and hashes a TTP leaves behind. Where sources attach a family or actor to an indicator, the report carries that attribution, which is the bridge from an address in a log to the TTP documentation that explains it.
Frequently Asked Questions
What is TTP (Tactics, Techniques, and Procedures)?
TTPs describe the behavior of threat actors: the high-level goals they pursue (tactics), the specific methods they use to achieve those goals (techniques), and the detailed, repeatable actions that implement those methods (procedures). The MITRE ATT&CK framework catalogues TTPs used by real adversaries.
How is TTP (Tactics, Techniques, and Procedures) related to IOC (Indicator of Compromise)?
TTP (Tactics, Techniques, and Procedures) and IOC (Indicator of Compromise) are both key concepts in threat intelligence. An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Related Terms
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
MITRE ATT&CK
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for threat detection, red team exercises, and gap analysis in security programs. The framework covers Enterprise, Mobile, and ICS environments.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.