TTPs - Tactics, Techniques, and Procedures

Learn how TTPs and the MITRE ATT&CK framework enable threat hunting, detection engineering, and behavioral security analysis.

Tactics, Techniques, and Procedures (TTPs) describe adversary behavior patterns that remain consistent across campaigns, tools, and infrastructure changes. Unlike indicators of compromise (IOCs) such as file hashes, IP addresses, or domain names that attackers rotate frequently, TTPs represent the fundamental methods adversaries use to achieve objectives—methods that require significant effort to change because they reflect attacker capabilities, tradecraft, and operational constraints.

Security engineers use TTPs as the foundation for threat hunting, detection engineering, and security architecture decisions. Understanding TTPs enables teams to build defenses that detect adversary behavior regardless of the specific tools or infrastructure used, creating detection capabilities that survive attacker adaptation and evasion attempts.

The TTP Hierarchy

TTPs form a hierarchical framework that describes adversary behavior at increasing levels of specificity. Understanding this hierarchy helps security teams develop detections at the appropriate abstraction level—general enough to catch variations, specific enough to minimize false positives.

Tactics represent the strategic objectives adversaries pursue during an intrusion. Each tactic answers "why" an adversary performs certain actions. The MITRE ATT&CK framework defines 14 enterprise tactics spanning the attack lifecycle: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Tactics provide the strategic context for understanding adversary goals at each stage of an operation.

Techniques describe "how" adversaries achieve tactical objectives through specific methods. Each tactic contains multiple techniques representing different approaches to the same goal. For example, the Initial Access tactic includes techniques like Phishing, Exploit Public-Facing Application, and Valid Accounts—each representing a distinct method for gaining entry to target environments. Techniques provide the behavioral signatures that SOC analysts use to identify adversary activity.

Procedures represent the specific implementation details unique to particular threat actors or campaigns. Procedures document exactly how adversaries execute techniques: the specific commands, tools, configurations, and operational patterns they employ. While two APT groups might both use PowerShell for execution, their procedures differ in command syntax, obfuscation methods, and execution patterns. Procedures enable attribution and help security teams understand adversary sophistication levels.

The MITRE ATT&CK Framework

The MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) framework is the industry-standard knowledge base for understanding and categorizing TTPs. Maintained by MITRE Corporation, ATT&CK provides a comprehensive matrix that maps real-world adversary behaviors observed in threat intelligence and incident investigations, enabling security teams to speak a common language when discussing threats.

ATT&CK organizes TTPs into a matrix format with tactics as columns and techniques as rows. This structure enables SOC analysts to understand both what adversaries are trying to achieve (tactics) and how they're achieving it (techniques). Each technique entry includes detailed descriptions, real-world examples, detection recommendations, and mitigations derived from observed adversary operations.

Sub-techniques provide granular details for specific implementations within each technique. For example, the Phishing technique (T1566) includes sub-techniques for spearphishing attachments (T1566.001), spearphishing links (T1566.002), and spearphishing via service (T1566.003). This granularity enables precise detection development and coverage tracking at the sub-technique level, which is essential for mature detection engineering programs.

The ATT&CK Navigator tool enables visualization of detection coverage across the ATT&CK matrix, helping security teams identify gaps and prioritize detection development. Organizations should map existing detections to ATT&CK techniques to understand coverage and focus development on high-risk gaps relevant to their threat model.

Detection Engineering with TTPs

TTP-based detection engineering creates behavior-focused rules that identify adversary techniques regardless of the specific tools or infrastructure used. This approach produces resilient detections that continue working even when adversaries change their tooling, modify their procedures, or implement evasion techniques designed to bypass signature-based detection.

Behavioral Pattern Detection

Effective behavioral detection focuses on the observable patterns that techniques must exhibit to succeed. PowerShell-based execution (T1059.001) requires specific process relationships, command-line patterns, and script block logging events regardless of the payload being executed. Credential dumping (T1003) produces characteristic memory access patterns and process interactions with LSASS that persist across different dumping tools. Security engineers develop detections targeting these behavioral invariants rather than signatures of specific tools.

Behavioral baselines enable anomaly detection by establishing normal patterns for users, systems, and applications. Deviations from established baselines—unusual process execution, abnormal network connections, atypical authentication patterns—indicate potential adversary activity. SIEM platforms and user behavior analytics systems correlate multiple signals to identify technique execution even when individual events appear benign in isolation.

Technique Chain Correlation

Real-world intrusions involve sequences of techniques executed across the attack lifecycle. Adversaries gain initial access, establish persistence, escalate privileges, discover targets, move laterally, and exfiltrate data. Each technique leaves traces that, when correlated, reveal the attack chain. Detection strategies that correlate technique sequences across time and systems identify campaigns that individual technique detections might miss.

Attack chain correlation requires sufficient telemetry across endpoints, networks, identity systems, and cloud control planes. Gaps in telemetry create blind spots where adversaries can operate undetected. Security teams should map required data sources for priority techniques and address collection gaps as infrastructure priorities.

Threat Hunting with TTPs

Threat hunting uses TTPs to formulate hypotheses about adversary activity that existing detections might miss. Rather than waiting for alerts, hunters proactively search for evidence of technique execution based on threat intelligence, detection coverage gaps, and environmental changes that introduce new attack surfaces.

Hunting prioritization should align with organizational risk assessment and threat model. Focus hunting efforts on techniques used by threat actors relevant to your industry, geography, and technology stack. ATT&CK's threat group profiles document techniques associated with named threat actors, enabling targeted hunting based on realistic threat scenarios.

Threat Actor TTP Patterns

Different threat actor categories exhibit distinct TTP patterns that reflect their objectives, resources, and operational constraints. Understanding these patterns helps security teams prioritize defenses and tailor detection strategies based on realistic threat scenarios relevant to their organization.

Advanced Persistent Threats (APTs)

APT groups emphasize stealth and long-term access, often maintaining presence in target environments for months or years before achieving objectives. They employ sophisticated evasion techniques including custom-developed tools, living-off-the-land binaries (LOLBins), and fileless malware designed to avoid detection. APT actors focus heavily on credential theft and lateral movement, taking a patient approach with minimal operational footprint to avoid triggering security alerts. Their techniques often require significant resources to develop, but their procedures are highly refined through operational experience.

Cybercriminal Groups

Financially-motivated cybercriminal groups prioritize speed and revenue over stealth, optimizing operations for maximum return on investment. They use commodity tools and established techniques that require minimal customization—ransomware toolkits, phishing kits, and exploitation frameworks available on criminal marketplaces. Cybercriminals focus on rapid data theft and ransomware deployment with techniques designed for efficiency rather than persistence. Their procedures follow predictable patterns that enable effective detection when security teams understand their operational playbook.

Nation-State Actors

Nation-state actors demonstrate advanced technical capabilities with access to significant resources for capability development. They frequently use zero-day exploits, custom implants, and sophisticated supply chain compromises that commercial threat intelligence may not cover. Their targets align with strategic intelligence priorities and critical infrastructure, reflecting broader geopolitical objectives. Nation-state techniques may include novel approaches not yet documented in ATT&CK, requiring security teams to develop detection hypotheses based on threat modeling rather than relying solely on documented techniques.

Implementing TTP-Based Security

Implementing TTP-based security requires systematic changes to assessment processes, SOC operations, and detection development practices.

Operational Challenges

TTP Evolution and Evasion

Adversaries continuously adapt techniques to evade detection, requiring security teams to maintain current threat intelligence and update detections accordingly. Living-off-the-land techniques that abuse legitimate tools present particular challenges because the underlying activities—PowerShell execution, WMI queries, scheduled task creation—are also used for legitimate administration. Effective detection requires behavioral context and baseline analysis to distinguish malicious use from normal operations.

Data Source Requirements

TTP-based detection often requires multiple data sources for accurate detection. Endpoint telemetry, network traffic, authentication logs, and cloud control plane events must be correlated to identify technique execution across the attack chain. Gaps in telemetry collection create blind spots where adversaries can operate undetected. Security teams should map required data sources for priority techniques and address collection gaps as infrastructure priorities.

False Positive Management

Behavioral detection generates higher false positive rates than signature-based detection because it targets activities that may also occur during legitimate operations. Effective alert tuning requires understanding normal operational patterns and developing detection logic that accounts for legitimate use cases. Organizations should establish baseline metrics for each detection and continuously refine based on analyst feedback and false positive analysis.

Technique Detection Examples

Credential Access Detection (T1003)

Credential dumping techniques target LSASS memory, SAM database, and cached credentials to harvest authentication material. Effective detection monitors process access to LSASS (Event ID 4663, Sysmon Event ID 10), unusual process relationships where unexpected processes interact with credential stores, and registry access to SAM hives. Cross-correlate with authentication events to identify credential harvesting followed by authentication attempts using harvested credentials—this chain provides high-confidence detection with lower false positive rates than individual technique detections.

Lateral Movement Detection (T1021)

Lateral movement techniques establish remote sessions to expand access across the network. Detection focuses on unusual SMB connections between workstations (workstation-to-workstation lateral movement is less common than workstation-to-server), authentication patterns indicating credential reuse across systems, and remote service creation or modification. Network security monitoring should identify connections to administrative shares (C$, ADMIN$) and remote execution services (WMI, PSExec, WinRM) from unexpected sources.

Command and Control Detection (T1071)

Command and control channels enable adversary communication with compromised systems. Detection targets unusual DNS query patterns (high query volume, domain generation algorithm indicators), HTTP/HTTPS connections to uncategorized domains, encrypted traffic to non-standard ports, and beaconing patterns in network traffic. DNS security monitoring and network traffic analysis provide visibility into C2 channels that endpoint detection may miss.

Automation and Platform Integration

Modern security platforms increasingly integrate ATT&CK frameworks to automate TTP-based detection and response. SOAR platforms enable technique-based response automation, triggering containment playbooks when specific techniques are detected and enriching alerts with ATT&CK context for analyst review. This integration transforms how organizations operationalize threat intelligence by connecting detection to automated response.

Machine learning models trained on TTP patterns enable automated threat classification and technique identification from raw telemetry. Security telemetry platforms can extract technique indicators from endpoint, network, and cloud events, reducing the manual analysis burden on SOC analysts. However, ML-based detection requires careful validation to ensure models accurately identify techniques without generating excessive false positives or missing evasion variants.

Cross-industry collaboration through Information Sharing and Analysis Centers (ISACs) and threat intelligence sharing platforms improves collective defense by pooling TTP observations across organizations. Shared threat intelligence enables earlier detection of emerging techniques and provides procedure-level details that individual organizations might not observe. Security teams should participate in relevant sharing communities and integrate shared intelligence into detection development workflows through threat intelligence platforms.

TTP Resources and References

Security teams implementing TTP-based security should leverage these authoritative resources:

Organizations should establish systematic processes for monitoring ATT&CK updates, as MITRE regularly adds new techniques, sub-techniques, and data sources based on observed adversary operations. Detection coverage assessments should be repeated quarterly to identify new gaps introduced by framework updates and emerging threats.