Tactics, Techniques, and Procedures describe how attackers operate. Tactics are high-level goals, techniques are methods to achieve them, and procedures are specific steps. Tracking these behaviors instead of simple file hashes allows you to detect new malware variants and sophisticated intrusions that evade signature-based security tools.
What exactly is a TTP in cybersecurity?
A TTP describes the behavior of an adversary rather than the specific tools they use. It breaks down an attack into three layers: the high-level goal, the method used to reach it, and the specific steps taken. This framework allows defenders to recognize an attack even if the attacker changes their software or infrastructure.
Tactics represent the strategic objective, such as gaining initial access or maintaining persistence. Techniques are the general approaches used to achieve those tactics, like phishing or exploiting a vulnerability. Procedures are the specific, granular actions, such as sending a phishing email with a particular subject line or using a specific command to dump credentials.
Why focus on behavior instead of indicators?
Indicators of Compromise (IOCs) are static data points like file hashes, IP addresses, or domain names. These indicators change rapidly as attackers modify their tools to evade detection. By the time you block a specific hash, the attacker has likely generated a new one.
Focusing on TTPs allows you to detect the underlying action regardless of the tool. If an attacker uses a new, unknown ransomware variant, the technique of encrypting files remains the same. You can detect this behavior through system call monitoring or file modification patterns, catching the threat even without a known signature. This approach is central to understanding how to monitor for advanced persistent threats who constantly change their surface artifacts.
How do TTPs map to the MITRE ATT&CK framework?
The MITRE ATT&CK framework is a globally accessible knowledge base of adversary tactics and techniques. It provides a common language that aligns directly with the TTP concept. Each technique in the framework has a unique ID and detailed description.
You use this framework to catalog what you can detect and where your gaps lie. For example, if you know an attacker often uses the "Valid Accounts" technique for initial access, you can check if your monitoring covers anomalous login behavior. This mapping turns abstract concepts into actionable detection engineering priorities. It also helps when you are analyzing threat actor profiling data to understand which specific paths an adversary prefers.
What is the difference between a technique and a procedure?
A technique is a general method, while a procedure is the specific implementation. Understanding this distinction is vital for tuning your detection rules. A technique for defense evasion might be "Indicator Removal on Host."
A procedure for that technique could be deleting specific Windows Event Log entries using the wevtutil command. Another procedure might involve clearing the Mac OS X unified log. If you only look for the specific command, you will miss the broader strategy. If you only look for the high-level tactic, your alerts will be too noisy. You need to balance broad technique coverage with specific procedure monitoring for high-value assets.
How do I identify TTPs in my own environment?
You start by correlating events from multiple sources into a single timeline. Single alerts rarely tell the whole story. You need to connect a login event, a process creation, and a network connection to see the full chain of activity.
Automated Security Orchestration, Automation, and Response (SOAR) platforms can help stitch these logs together. However, you must ensure your logging covers the necessary depth. Many organizations miss procedure-level details because they only collect standard audit logs. To catch subtle movements, you may need to implement process injection detection capabilities that monitor for unusual memory activity.
See also: Honeypots: 9 FAQs on Deployment, Detection and Data Quality · Advanced Persistent Threats: How to Spot Hidden Network Intrusions
What are the common mistakes when tracking TTPs?
The most common mistake is treating TTPs as a static checklist. Attackers adapt their behavior based on the defenses they encounter. If you block a specific technique, the adversary may pivot to a different path that achieves the same tactical goal.
Another error is assuming that detecting a technique means you have stopped the attack. Detection is only the first step. You must have the capability to respond. For instance, detecting Active Directory attacks like Kerberoasting is useless if you cannot disable the compromised service account quickly. Always map detections to response playbooks.
How does adversary emulation use TTPs?
Adversary emulation involves simulating attacks based on real-world TTPs to test your defenses. Unlike simple vulnerability scanning, this method mimics the steps a real attacker would take. It validates whether your detection and response mechanisms work under realistic conditions.
You define a scenario based on a specific adversary’s known behavior. Then, you execute the techniques in a controlled manner. This process highlights gaps in visibility that traditional testing misses. It also helps you understand the lateral movement paths available in your network, which is critical for mitigating risks associated with DCSync attacks that replicate credential data.
| TTP Level | Definition | Example |
|---|---|---|
| Tactic | The strategic goal | Initial Access |
| Technique | The method to achieve the goal | Valid Accounts |
| Procedure | The specific implementation | Using stolen credentials from a password dump |
Can I automate TTP detection and response?
Yes, but automation requires high-fidelity data and precise rules. Automated systems can correlate events faster than humans. They can trigger isolation actions when a specific sequence of TTPs is detected.
However, automation amplifies errors. If your rule is too broad, you will disrupt legitimate business operations. If it is too narrow, attackers will bypass it. You must continuously tune these rules based on feedback from your security operations team. Integration with packet capture analysis can provide the deep context needed to reduce false positives in automated responses.
How do TTPs help in post-incident analysis?
Post-incident analysis uses TTPs to reconstruct the attack chain. This reconstruction reveals how the attacker moved through your environment. It identifies which defenses failed and where new controls are needed.
By mapping the incident to known TTPs, you can also check if the attacker achieved their ultimate tactical goals. Did they exfiltrate data? Did they establish persistence? This analysis informs your long-term strategy and helps prioritize security investments. It also provides data for updating your honeypots to better detect similar future attempts.
Key takeaways
- TTPs provide a stable language for describing attacker behavior across different tools and teams.
- Mapping your environment to known techniques reveals blind spots before an intrusion occurs.
- Procedure-level analysis often requires deeper telemetry than most organizations currently collect.
Track attacker behavior rather than static signatures to catch evolving threats that bypass traditional tools. Audit your detection coverage against the MITRE ATT&CK framework to find and fill your security blind spots.
Frequently asked questions
Do I need to know every TTP to be secure?
No, focus on the techniques most relevant to your industry and environment. Prioritize based on risk and asset value rather than attempting to detect every possible method.
How often should I update my TTP monitoring?
Update your monitoring rules whenever you identify new attack trends or after significant changes to your infrastructure. Regular reviews ensure your defenses keep pace with evolving adversary behavior.
Can small organizations use TTP-based defense?
Yes, start with a limited set of high-impact techniques. Use cloud-based security services that provide built-in TTP detection capabilities to reduce the operational overhead of manual monitoring.
What data sources are best for TTP detection?
Endpoint detection and response (EDR) logs, network flow data, and identity logs provide the best coverage. Combine these sources to get a complete view of attacker activities across your environment.
How this guide was produced: written by the SecOps Monitor editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
