Tactics, Techniques and Procedures (TTP)

Tactics, Techniques and Procedures (TTPs) describe adversary behavior at three levels of specificity. Tactics are the attacker's overall goal at a given stage of an intrusion, such as gaining initial access or exfiltrating data. Techniques are the general method used to achieve that goal, such as exploiting a public-facing application. Procedures are the specific, detailed implementation a particular actor uses, such as the exact exploit chain, tooling and sequence of commands a named threat group is known to run.

The TTP framing exists because indicators of compromise, such as file hashes or IP addresses, are cheap for attackers to change and therefore have a short useful life for defenders. Behavior described as TTPs is far harder to change because it reflects a genuine capability or constraint on the attacker's side. A group that specializes in phishing followed by credential harvesting will keep using that approach because it is what they are equipped and practiced to do, even as the specific domains and payloads they use rotate constantly.

MITRE ATT&CK is the most widely used public catalog for organizing TTPs, giving defenders a shared vocabulary to describe what a given actor typically does at each stage of an attack. Threat intelligence reports commonly describe a group's activity in terms of ATT&CK technique IDs rather than only prose, which lets defenders directly compare their own detection coverage against a specific actor's known playbook.

TTP-based thinking changes how exposure and detection programs prioritize work. Instead of asking only whether a given vulnerability is patched, a TTP-informed program asks whether the organization would detect and respond to the specific behaviors that actors targeting its industry or region are known to use, such as exploiting internet-facing VPN appliances, abusing valid accounts obtained through credential stuffing, or moving laterally through exposed remote management tools. This is also why external exposure data is useful for TTP-based prioritization: an internet-facing asset that matches a technique known to be favored by active threat actors in a given sector deserves attention even if its raw vulnerability severity looks moderate.

Understanding an organization's likely TTP exposure typically combines three inputs: what actors are known to be active against similar organizations, what techniques those actors favor, and which of the organization's exposed assets and services would let those specific techniques succeed. That combination is what turns a generic vulnerability list into a threat-informed priority list.