Tactics, Techniques, and Procedures (TTPs) Explained for Beginners
Tracking attacker behavior patterns rather than specific file signatures allows you to detect novel threats that bypass traditional signature-based defenses.
Tactics, techniques, and procedures define how attackers operate. Tactics are the strategic goals, techniques are the methods to achieve them, and procedures are the specific tools used. Monitoring these behaviors lets you spot intrusions even when the malware is new or unknown.
The Heist Analogy
Imagine a burglar planning to steal a painting. The tactic is the strategic goal: bypassing the security system to reach the artwork. This is the "what" and "why" of the intrusion. The burglar does not care about the specific brand of lock pick yet; they only care about gaining entry.
The technique is the method chosen to achieve that tactic. The burglar might decide to pick the lock, cut through the window, or distract the guard. This is the "how." It is a general approach that can be applied in many different scenarios.
The procedure is the specific execution. The burglar uses a particular tension wrench and a specific rake pick to open the Yale lock on the front door. This is the observable action. If you only watch for that specific rake pick, you miss the burglar who uses a screwdriver or a glass cutter.
Defining the Hierarchy
Security professionals use this hierarchy to categorize threats. It moves from abstract strategy to concrete action. This structure helps you understand the attacker's intent rather than just reacting to a single file.
Tactics align with the phases of an attack. Common tactics include initial access, execution, persistence, and exfiltration. These are the milestones the attacker aims to hit.
Techniques bridge the gap between goals and tools. For example, "phishing" is a technique used for the tactic of initial access. "Credential dumping" is a technique used for the tactic of discovery or lateral movement.
Procedures are the granular details. This includes the specific email subject line, the exact PowerShell command, or the unique IP address used for command and control traffic. These details change frequently to evade detection.
| Term | Plain meaning |
|---|---|
| Tactic | The strategic goal or phase of the attack. |
| Technique | The general method used to achieve the tactic. |
| Procedure | The specific tool, command, or action taken. |
| Indicator of Compromise | A forensic artifact like a file hash or IP. |
| Behavior | The pattern of actions an attacker performs. |
The Hidden Cost of Signature Detection
Traditional antivirus software relies on signatures. A signature is a unique fingerprint of a known malicious file. This is equivalent to watching for the burglar’s specific rake pick.
This approach fails when the attacker changes the tool. If the burglar switches to a screwdriver, the signature-based detector sees nothing unusual. The file hash changes, but the behavior remains the same.
This is why living-off-the-land attacks are so dangerous. Attackers use legitimate system tools like PowerShell or WMI to perform malicious tasks. There is no malicious file to sign. The procedure is valid, but the context is wrong.
Common Points of Confusion
Many readers confuse Indicators of Compromise (IOCs) with TTPs. IOCs are static artifacts. They include file hashes, domain names, and IP addresses. These are easy to collect but decay quickly.
TTPs are behavioral. They describe the pattern of activity. An IOC might be a specific URL. The TTP is the act of beaconing to a remote server. The URL changes, but the beaconing pattern often remains consistent.
Another confusion lies in the granularity of techniques. A technique like "Phishing" can be broken down into sub-techniques like "Spearphishing Attachment" or "Spearphishing Link." Understanding this depth helps you tune your defenses.
Why Behavior Matters More
Tracking TTPs allows you to detect novel threats. If you monitor for the technique of "Credential Dumping," you can spot LSASS credential theft attempts regardless of the tool used.
This is critical for initial access brokers who sell access to networks. They often use different tools for different clients, but their goal—establishing persistent access—remains the same.
By focusing on behavior, you can automate responses. SOAR platforms can trigger actions based on detected techniques. If a device exhibits signs of lateral movement, the system can isolate it automatically.
See also: Threat Intelligence Programs: Definition, Purpose and Core Components · Threat Intelligence Platforms: Real Value vs Operational Noise
Practical Application for Small Teams
You do not need a large security operations center to use TTPs. Start by identifying the tactics that matter most to your business. For most organizations, initial access and data exfiltration are the primary concerns.
Review your SOC playbooks to ensure they address specific techniques. If your playbook for phishing only mentions blocking emails, it is incomplete. It should also cover user training and incident response steps.
Use endpoint telemetry to collect data on process creation and network connections. This data allows you to reconstruct the procedure an attacker used. Without this data, you cannot distinguish between normal admin activity and malicious behavior.
Try This Now
- Select one high-risk tactic, such as "Initial Access," and list the common techniques used to achieve it, like phishing or exploiting public-facing services.
- Review your current detection rules. Identify which rules rely solely on static IOCs like IP addresses or file hashes.
- Update one rule to detect the underlying technique. For example, instead of blocking a specific malicious domain, monitor for unusual outbound connections to new domains from web browsers.
Integrating with Security Metrics
Measuring the effectiveness of your defenses requires looking at TTPs. Security metrics should track how quickly you detect and respond to specific techniques.
If your detection time for "Privilege Escalation" is consistently high, you need to improve your monitoring for that technique. This is more useful than tracking the number of viruses blocked.
This approach shifts your focus from counting alerts to measuring risk reduction. It ensures your resources are spent on stopping the most impactful attack behaviors.
Key takeaways
- Tactics describe the attacker's high-level objective within the attack lifecycle.
- Techniques are the general methods used to achieve those tactical objectives.
- Procedures are the specific, observable actions and tools used to execute a technique.
TTPs provide a behavioral framework that outlasts specific malware signatures. Start mapping your detection rules to attack techniques rather than just file hashes.
Frequently asked questions
What is the difference between an IOC and a TTP?
An IOC is a specific artifact like a file hash or IP address, while a TTP describes the behavior or method an attacker uses, which is more persistent across different attacks.
Do I need expensive tools to track TTPs?
No, you can start by analyzing logs for behavioral patterns. The key is focusing on the method of the attack rather than just the specific files involved.
How do TTPs help with living-off-the-land attacks?
Since these attacks use legitimate tools, there are no malicious file signatures. Tracking TTPs helps you spot abnormal use of standard system tools.
Are TTPs static or do they change?
TTPs evolve slowly. Attackers may change their procedures and tools, but their core tactics and techniques often remain consistent for years.
How this guide was produced: written by the Shell Bulletin editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
