Tactics, techniques, and procedures (TTPs) break down cyberattacks into logical stages. Tactics are the goals, techniques are the methods to achieve them, and procedures are the specific steps taken. Understanding this hierarchy allows you to build detections that catch new attacks using known behaviors, rather than relying solely on identifying unique malware files or indicators of compromise.
Understanding the TTP Hierarchy
Tactics, techniques, and procedures (TTPs) form a structured way to understand adversarial behavior. This framework moves from abstract goals to concrete actions. Tactics represent the "why" or the objective of a specific step in an attack, such as gaining initial access or escalating privileges. Techniques describe the "how," the general method used to achieve that tactical goal, such as using a phishing email or exploiting a software vulnerability. Procedures are the specific, granular steps an attacker takes to execute a technique, including the exact commands, tools, or configurations used.
This hierarchy matters because tactics and techniques remain relatively stable over time. Attackers change their procedures constantly to evade detection. If you build your security monitoring only around specific procedures, such as a particular file hash or IP address, your defenses fail the moment the attacker changes those details. By focusing on techniques, you create a broader net that catches variations of the same behavior.
Stage 1: Initial Access and Reconnaissance
The first stage involves the attacker establishing a foothold in your environment. This often begins with passive reconnaissance, where the adversary gathers information about your network structure, employee names, and public-facing services. Active reconnaissance follows, involving direct interaction with systems to probe for weaknesses.
Common techniques here include spear-phishing emails designed to trick users into clicking malicious links. Another frequent method is exploiting publicly disclosed vulnerabilities in internet-facing applications. You can detect this by monitoring for unusual outbound connections from user workstations or failed login attempts from unknown geographic locations.
Stage 2: Execution and Persistence
Once inside, the attacker must run code to maintain control. Execution refers to the methods used to run malicious software. This might involve a legitimate system utility being abused to run a script, a tactic known as living-off-the-land. Persistence ensures the attacker can return even after a system reboot. Techniques include creating scheduled tasks, adding entries to startup folders, or modifying registry keys.
At this stage, the focus shifts from network traffic to endpoint behavior. You should monitor for processes spawning unexpected child processes. For example, a web browser launching a command shell is highly suspicious. Detecting persistence requires watching for changes to system configuration files that are rarely modified in normal operations.
Stage 3: Privilege Escalation and Discovery
Most initial access occurs with limited user rights. To move deeper, attackers use privilege escalation techniques to gain higher-level permissions. This might involve exploiting a local kernel vulnerability or abusing misconfigured service accounts. Discovery happens concurrently, as the attacker maps the internal network to find valuable assets.
They may use built-in operating system tools to list running processes, network connections, or user accounts. This lateral movement preparation is often invisible to perimeter defenses. You can detect this by looking for the use of administrative tools by standard users or spikes in internal DNS queries for internal hostnames.
Stage 4: Lateral Movement and Credential Access
With elevated privileges, the attacker moves across the network. Lateral movement involves transitioning from one system to another. Credential access is often the fuel for this movement, involving the theft of login tokens, password hashes, or session cookies.
Techniques include pass-the-hash, where stolen password hashes are reused to authenticate to other systems without knowing the plaintext password. In environments relying on directory services, attackers may use protocols like LDAP to dump user data. Understanding Active Directory attacks is relevant here, as many lateral movement techniques exploit weaknesses in identity management rather than network flaws.
See also: Honeypots: 9 FAQs on Deployment, Detection and Data Quality · Advanced Persistent Threats: How to Spot Hidden Network Intrusions
Stage 5: Collection and Exfiltration
The final operational stages involve gathering the target data and sending it out. Collection aggregates data from endpoints or network shares. Exfiltration transfers that data to an external server controlled by the attacker.
Attackers often use legitimate cloud storage services or encrypted channels to blend their data theft with normal traffic. Detecting exfiltration requires baseline understanding of normal data flow volumes. A sudden spike in outbound traffic from a database server is a strong indicator. For deeper visibility, packet capture analysis can reveal hidden data channels within seemingly innocuous protocols.
| Stage | What happens | Where it can be stopped |
|---|---|---|
| Initial Access | Attacker gains entry via phishing or exploit | Email security gateways, Web Application Firewalls |
| Execution | Malicious code runs on a host | Endpoint Detection and Response, Application Whitelisting |
| Privilege Escalation | Permissions are raised to admin levels | Least privilege policies, Patch management |
| Lateral Movement | Attacker moves between internal systems | Network segmentation, Zero Trust architecture |
| Exfiltration | Data is stolen and sent outside | Data Loss Prevention, Egress filtering |
Applying TTPs to Detection Engineering
Reading TTPs requires translating abstract descriptions into observable events. Start with the technique description to understand the underlying mechanism. Then, identify the telemetry sources that would record this action. For example, if a technique involves file creation, you need file integrity monitoring logs. If it involves process execution, you need process creation logs.
This approach aligns with the Diamond Model of intrusion analysis, which connects the adversary, infrastructure, victim, and capability. By mapping TTPs to this model, you can prioritize detections based on the criticality of the asset and the sophistication of the threat. Adversary emulation exercises can then test whether your detections actually fire when these techniques are simulated.
Common Pitfalls in TTP Analysis
A frequent mistake is treating all procedures as equal. Not every instance of a technique indicates a threat. Some administrative tasks mimic attack behaviors. To reduce false positives, you must understand the context of normal operations.
Another pitfall is focusing too heavily on advanced persistent threats while ignoring common, low-sophistication attacks. Most breaches result from simple techniques executed poorly by defenders. Ensure your baseline coverage includes standard TTPs before adding complex, niche scenarios. Remember that threat actor profiling helps prioritize which TTPs are most relevant to your specific industry and technology stack.
Integrating with Broader Security Operations
TTPs do not exist in isolation. They inform incident response playbooks and vulnerability management priorities. When a new vulnerability is disclosed, map it to the TTPs it enables. This helps you prioritize patching based on how likely it is to be exploited in the wild.
Regularly review your detection rules against updated TTP frameworks. As attackers develop new procedures, your detection logic must evolve. However, the underlying techniques often remain the same. By anchoring your strategy to techniques, you maintain a stable foundation for your security operations.
Key takeaways
- TTPs provide a structural map of an attack, separating the attacker's intent from the specific tools used.
- Detecting at the technique level creates resilient defenses that survive changes in malware code.
- Procedure-level analysis offers high-fidelity alerts but requires significant manual tuning to avoid noise.
Focus on detecting behavior at the technique level to stay ahead of evolving attack procedures. Map your existing telemetry sources to common TTPs to identify coverage gaps immediately.
Frequently asked questions
What is the difference between IOCs and TTPs?
IOCs are specific artifacts like file hashes or IP addresses, while TTPs describe the behavioral methods an attacker uses. IOCs change frequently; TTPs remain stable over time.
How do I find TTPs for specific threats?
Open-source frameworks categorize known TTPs by technique. You can search these frameworks by software vulnerability or threat type to find relevant behavioral descriptions.
Can TTPs help with incident response?
Yes, knowing the typical TTPs for a specific technique helps responders understand the scope of an incident and identify related compromise indicators across the network.
Do I need to track procedures?
Tracking procedures provides high-fidelity alerts but increases maintenance overhead. Start with technique-level detection and add procedure-specific rules only for high-risk scenarios.
How this guide was produced: written by the SecOps Monitor editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
