TTPs (Tactics, Techniques, Procedures)

One-liner: The hierarchy describing why an adversary acts (Tactics), what they do (Techniques), and how they do it (Procedures).

🎯 What Is It?

TTPs represent the behavioral patterns of threat actors—from high-level goals down to specific implementation details. Understanding TTPs enables defenders to detect adversaries based on behavior rather than easily-changed indicators like IP addresses or file hashes.

🤔 Why It Matters

TTPs sit at the top of the Pyramid of Pain—they're the hardest thing for adversaries to change. An attacker can trivially change their malware hash or C2 IP, but changing their entire operational methodology is expensive and time-consuming.

        /\
       /  \  ← TTPs (HARD to change)
      /    \
     / Tools \
    /──────────\
   / Network/   \
  /   Host       \
 /   Artifacts    \
/──────────────────\
     Hashes         ← (EASY to change)

🔬 How It Works

The TTP Hierarchy

TACTIC: Persistence (TA0003)
   │
   ├── TECHNIQUE: Scheduled Task/Job (T1053)
   │       │
   │       ├── SUB-TECHNIQUE: Scheduled Task (T1053.005)
   │       │
   │       └── PROCEDURE: APT29 creates task via schtasks.exe
   │                      at login with SYSTEM privileges
   │
   └── TECHNIQUE: Boot/Logon Autostart (T1547)
           │
           └── SUB-TECHNIQUE: Registry Run Keys (T1547.001)

MITRE ATT&CK Mapping

The ATT&CK framework catalogs known TTPs:

• 14 Tactics — Adversary goals across the attack lifecycle
• 200+ Techniques — Methods to achieve each tactic
• 600+ Sub-techniques — Granular variations
• Procedures — Real-world examples from APT groups

📊 Tactics Overview (Enterprise)

🛡️ Detection & Prevention

How to Detect (TTP-based Detection)

TTP-based detection focuses on behavior patterns rather than IOCs:

Why TTP Detection > IOC Detection

🎤 Interview Angles

Common Questions

• "What are TTPs and why are they important for threat detection?"
• "How do TTPs relate to the Pyramid of Pain?"
• "Give an example of detecting based on TTPs vs IOCs."

STAR Story

Situation: SOC relied entirely on IOC feeds; attackers bypassed by changing hashes.
Task: Improve detection resilience against evasive threats.
Action: Shifted focus to TTP-based detection using MITRE ATT&CK. Built behavioral rules for credential dumping (LSASS access), persistence (scheduled tasks from unusual paths), and lateral movement (remote service creation). Validated with Atomic Red Team.
Result: Detected red team engagement that previous IOC-based approach missed completely. Reduced reliance on threat intel freshness.

✅ Best Practices

• Map your detections to ATT&CK techniques—visualize coverage gaps
• Prioritize high-impact TTPs relevant to your threat model
• Use Atomic Red Team to test TTP-based detections
• Combine TTP detection with IOC matching for defense-in-depth
• Update TTP knowledge as adversaries evolve

❌ Common Misconceptions

• "TTPs = MITRE ATT&CK" — ATT&CK is a TTP catalog, but TTPs exist independently
• "Detect TTPs, ignore IOCs" — Use both; IOCs are fast, TTPs are resilient
• "One detection per technique" — Techniques have many procedures; need multiple rules

🔗 Related Concepts

• MITRE ATT&CK
• Pyramid of Pain
• Threat Emulation
• Detection Engineering
• Threat-based detection
• Indicator Detection
• Cyber Threat Intelligence (CTI)

📚 References

• MITRE ATT&CK: https://attack.mitre.org/
• MITRE ATT&CK Navigator
• SANS TTP-based Detection Strategies