What Are TTPs (Tactics, Techniques, and Procedures)?

TTPs dissect attacker actions into three distinct layers of detail:

• Tactics represent the adversary’s high-level goals or the ‘why’ behind their actions at various stages of an attack. The MITRE ATT&CK framework categorizes these tactics into areas such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
• Techniques describe the ‘how,’ defining the general methods used to achieve a tactic. For example, ‘Command and Scripting Interpreter’ (T1059) is a technique under the Execution tactic, and ‘Phishing’ (T1566) is a technique under Initial Access. Many techniques also feature sub-techniques for added precision, like ‘Spearphishing Attachment’ (T1566.001).
• Procedures detail the ‘how exactly,’ representing the specific, concrete implementations of a technique by an adversary. This includes the exact commands, tools, or sequences of actions used. Two threat actors might employ the same technique (e.g., PowerShell execution), but their specific commands and obfuscation methods (procedures) could differ significantly.

The MITRE ATT&CK framework assigns a unique ID to each technique (e.g., T1059) to ensure a common global language. This allows analysts to map observed activities to these IDs, enabling the development of targeted detections, the execution of purple-team exercises, and the measurement of security coverage.

Consider a phishing-led intrusion. The process can be broken down into TTPs as follows:

• TACTIC: Execution
  TECHNIQUE: Command and Scripting Interpreter: PowerShell (T1059.001)
  PROCEDURE: powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBi...
• TACTIC: Initial Access
  TECHNIQUE: Phishing: Spearphishing Attachment (T1566.001)
  PROCEDURE: A weaponized .docm file with a macro that drops and runs a loader.
• TACTIC: Credential Access
  TECHNIQUE: OS Credential Dumping: LSASS Memory (T1003.001)
  PROCEDURE: rundll32.exe comsvcs.dll, MiniDump <lsass_pid> C:tempout.dmp

In this example, the tactic clarifies the adversary’s objective, the technique (identified by its MITRE ID) explains the method used, and the procedure provides the specific command line or action that can be hunted for. The LSASS memory dump using comsvcs.dll is a known procedure that allows for credential harvesting without deploying obvious tools, making detection of this specific command line a powerful, actor-agnostic hunt.

TTPs represent the highest value in threat intelligence because they are the most difficult for adversaries to change. While attackers can quickly swap out indicators like domains or IP addresses, or even recompile malware within hours, retraining an entire operational team to abandon their preferred techniques requires significant time, resources, and effort.

By building detections around an adversary’s TTPs, organizations compel attackers to face a difficult choice: either fundamentally alter their operational methods, incurring substantial costs and effort, or risk being continuously detected and thwarted. This principle aligns with the logic of the Pyramid of Pain, where TTP-based detection forces adversaries to make more costly changes. Furthermore, TTP analysis is crucial for attribution, enabling analysts to link new intrusions to known threat groups based on their behavioral fingerprints. Platforms like SOCRadar leverage TTP profiling to help defenders prioritize defenses against the techniques most likely to be exploited.

An analogy can be drawn to burglary: the tactic might be ‘gaining entry,’ the technique ‘picking locks,’ and the procedure the specific tools, brands of picks, and hand movements a burglar consistently uses. While a burglar can easily change their getaway car (an IOC), their signature techniques are much harder to abandon.

What is the difference between a technique and a procedure? A technique is the general method an adversary uses (e.g., using PowerShell for execution). A procedure is the specific, concrete implementation of that technique by a particular actor, such as the exact command line, script, or tool used.

Where do TTPs come from? TTPs are cataloged and documented in frameworks like MITRE ATT&CK, which are built from observations of real-world adversary behavior documented across thousands of security incidents.

Why are TTPs harder to change than IOCs? TTPs reflect an adversary’s ingrained skills, preferred tooling, and operational habits. Modifying these requires significant retraining and retooling, which is a far more substantial undertaking and costlier than simply rotating a domain name or a malicious hash value.