Tactics, techniques and procedures
noun · also TTP, TTPs · MITRE ATT&CK
How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).
TTPs describe an attacker's behavior at three levels of detail:
- Tactic: the why, the short-term goal of an action, such as gaining initial access or stealing credentials.
- Technique: the how, the general method used to reach that goal, such as phishing or dumping credentials from memory.
- Procedure: the specifics, the exact tools, commands and steps a particular group used in a real attack.
MITRE ATT&CK is organized exactly this way: tactics as columns, techniques and sub-techniques as entries, and procedure examples documented from public reporting.
Example
Tactic: Credential Access. Technique: OS Credential Dumping (T1003). Procedure: a specific group running a renamed copy of a credential dumping tool against the memory of the LSASS process on domain controllers, at night, from a compromised backup server.
Why it matters for a SOC analyst
Indicators such as IP addresses and file hashes are easy for attackers to change. Their TTPs are not, because changing how you operate takes time and skill. This idea is often illustrated with David Bianco's "Pyramid of Pain", which puts TTPs at the top: detections built on behavior keep working long after the indicators from the last report have expired.
Related terms
- MITRE ATT&CK
A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.
- Threat hunting
The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.