Cybersecurity glossary
What are Tactics, Techniques and Procedures (TTP)?
Learn what Tactics, Techniques and Procedures (TTPs) are, how they describe adversary behavior, how they differ from IOCs, and how defenders use them for hunting and detection coverage.
Definition
Tactics, Techniques and Procedures (TTPs) describe how adversaries operate: the tactical goals they pursue, the techniques they use to achieve them, and the specific procedures or implementations observed in real campaigns.
Why behavior outlasts infrastructure
A domain used on Tuesday is gone on Wednesday. The reason it existed—command and control after a phish—remains. Tactics, Techniques and Procedures (TTPs) name that lasting layer of adversary tradecraft so defenders can hunt and detect without waiting for the next hash.
If your detections only match IOCs, you are memorizing license plates, not driving patterns.
The three layers
Tactics
Adversary goals along an intrusion: initial access, persistence, credential access, exfiltration. ATT&CK columns are the usual vocabulary.
Techniques
Classes of method used to meet a goal: valid accounts, phishing, scheduled task, OS credential dumping.
Procedures
The messy reality: which payload, which command line, which cloud API sequence this actor used last month.
Your environment’s overlay
The same technique looks different on Windows laptops versus Kubernetes versus SaaS-only tenants.
Using TTPs without boiling the ocean
Pick priority tactics
Start from your incidents and sector intel, not from a mandate to “cover all of ATT&CK.”
Inventory visibility
A technique you cannot observe is a prevention or logging gap, not a SIEM rule waiting to be written.
Encode procedure variants
Detections should allow for renaming and living-off-the-land, not one vendor demo command.
Test with purple exercises
Safe emulation shows whether the TTP lights up EDR, identity, or nothing.
Record what attackers actually did
Incident TTPs become the coverage backlog. Unused catalog rows can wait.
TTP versus IOC in operations
| Object | Example | Defender move |
|---|---|---|
| IOC | SHA-256 of this week’s loader | Block and hunt historically, then expire |
| Technique | T1053 Scheduled Task / Job | Alert on rare authors, odd paths, and odd hours |
| Procedure | Actor X drops a task named WindowsUpdateCheck | Exact match plus fuzzy variants in hunting |
| Tactic | Persistence after initial access | Ensure at least one strong control per major path |
- Map high-severity incidents back to techniques; do not stop at malware family names.
- Prefer detections that include identity and asset context, not only a command-line regex.
- Document living-off-the-land lookalikes used by your own IT automation.
- Use ATT&CK IDs in tickets so coverage and intel share a language.
- Retire procedure-specific rules when the actor changes packaging—keep the technique coverage.
- Hunt for techniques you cannot yet alert on without drowning the SOC.
- Include SaaS and identity TTPs; not every procedure lives on a Windows host.
- Measure coverage as “prevent, detect, or accepted gap” per priority technique.
The practical takeaway
TTPs describe how adversaries work, not which file they shipped this morning. Name the tactic, detect the technique with room for procedure drift, and spend IOC effort on the campaign that is still in your network today.
Related security terms
MITRE ATT&CK
The most widely used catalog for naming tactics and techniques.
Indicator of Compromise (IOC)
Perishable artifacts that sit below TTPs in the pyramid of pain.
Detection Engineering
Encodes TTPs as analytics that survive infrastructure changes.
Threat Intelligence
Sources and analysis that describe which TTPs which actors reuse.
Purple Team
Exercises that validate whether your stack sees a given TTP.
Frequently asked questions
What are TTPs in simple terms?
They are the playbook of an attacker: what they are trying to achieve, the methods they choose, and the exact way they run those methods in a campaign.
How do tactics, techniques, and procedures differ?
A tactic is the goal (for example, persist). A technique is a class of method (scheduled task). A procedure is the concrete implementation (which binary, which arguments, which naming pattern).
Why are TTPs more valuable than IOCs?
Hashes and domains rotate. Behaviors like dumping credentials from LSASS or granting a malicious OAuth app keep returning. Detecting the behavior raises the attacker’s cost.
Is every ATT&CK technique a TTP?
ATT&CK techniques and sub-techniques are a standard way to name techniques. Full TTPs include the procedure details from a specific actor or incident.
How should SOCs use TTPs?
Map detections and controls to the techniques that match your threat model, hunt for procedure variants, and record which TTPs appeared in real incidents.
What is the pyramid of pain?
David Bianco’s model ranking how much it hurts attackers when you detect hashes versus domains versus TTPs. Behavioral detections sit near the top.
Can TTPs create alert noise?
Yes. Admin tools overlap with attacker techniques. Procedure-level detail and context (who, where, when) separate living-off-the-land from IT automation.
References
Explore authoritative guidance and frameworks related to tactics, techniques and procedures (ttp).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.