What is a TTP?
TTP stands for tactics, techniques, and procedures.
It is a way to describe what an attacker is trying to do, how they do it, and the more specific way they carry it out.
Simple breakdown
- Tactic: the attacker’s goal
- Technique: the method used to reach that goal
- Procedure: the specific implementation or step-by-step behavior
Example
Imagine an attacker wants access to an account.
- Tactic: credential access
- Technique: phishing
- Procedure: sending a fake Microsoft 365 login page to employees and collecting submitted passwords
Why TTPs matter
TTPs help defenders focus on behavior instead of only indicators like IP addresses or file hashes.
An IP address can change quickly. A behavior pattern often lasts longer.