← Glossary

Threat Intel Concepts

TTP (Tactics, Techniques and Procedures)

Also: Tactics, Techniques and Procedures · TTPs · tradecraft · attacker behaviour

In one sentence

TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).

Why it matters

Threat actors are recognised by their habits more reliably than by their tools. Two ransomware crews may share the same leaked builder, but one always disables backups through vssadmin while the other uses wmic shadowcopy delete and runs at 02:00 local time on a Friday. Those habits are TTPs, and they matter for three audiences:

  • Threat intelligence attributes activity and predicts the next step ("this group always exfiltrates to Mega before encrypting — watch outbound").
  • Detection engineering builds rules at the technique level (see IOA), which is where the attacker cannot cheaply change behaviour.
  • Red teams and tabletop exercises emulate a specific actor's TTPs instead of generic "hacking", so the exercise tests the defences that actor would meet.

At the top of the Pyramid of Pain, forcing an attacker to change TTPs means forcing them to retrain. That is the most expensive thing a defender can do to them.

The three levels

Tactic — the objective at a stage of the intrusion. ATT&CK fixes fourteen for Enterprise: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Technique — a general method for achieving the tactic, independent of tooling. T1003.001 LSASS Memory covers every way of reading the LSASS process to obtain credentials. Techniques are what detection rules and coverage maps are written against.

Procedure — the specific implementation observed for one actor or one malware family: which binary, which arguments, which order, which timing. ATT&CK records these under each technique as "procedure examples" (e.g. a named group "has used Mimikatz's sekurlsa::logonpasswords"). Procedures are where IOCs come from and where actor-specific emulation plans get their detail.

A threat profile for an actor is therefore a list of techniques with procedures attached — and a defender's coverage question is "for each technique in the profile, do we log the data source and do we have a rule?"

Try it yourself hands-on

A sector CERT advisory says a ransomware group targeting your industry uses "PowerShell for execution, scheduled tasks for persistence, LSASS dumping for credentials, RDP for lateral movement, and shadow-copy deletion before encryption". Build the profile and the gap list.

  1. In the MITRE ATT&CK Search, look each behaviour up and record the technique ID: PowerShell → T1059.001; scheduled tasks → T1053, sub-technique .005 Scheduled Task in its list; LSASS → T1003 / .001 LSASS Memory; RDP → T1021 / .001; encryption → T1486, whose detection guidance also covers the shadow-copy deletion that precedes it (the dedicated technique, T1490 Inhibit System Recovery, is on attack.mitre.org — the search tool carries a curated subset). Each entry lists the detection data sources — note them: process creation and command line, scheduled-job creation, LSASS process access (Sysmon 10), logon sessions, and file modification events.
  2. Get to the procedure level for the living-off-the-land steps with the LOLBin Browser: wmic.exe, rundll32.exe and certutil.exe each list the abuse patterns seen in the wild and the technique they map to. Those command lines become the selection of a Sigma rule. (schtasks and vssadmin are ordinary admin tools rather than catalogued LOLBins; their abuse is documented under the technique entries themselves.)
  3. Build the coverage table: six techniques, one row each, columns "data source collected?" and "rule exists?". Typical result on a first pass: PowerShell and scheduled tasks covered; LSASS access not logged (no Sysmon Event 10); RDP lateral movement logged but no rule for off-hours or new source-destination pairs; shadow-copy deletion unlogged. Two gaps with a data-source fix, one with a rule fix.
  4. Rehearse it. The Tabletop Generator turns the same TTP chain into an exercise script — injects in tactic order — so the incident team practises against this actor's playbook rather than a generic scenario.

Common misreadings

  • "TTP" is often used to mean "technique" alone. Ask which level a report is describing; a tactic-level statement ("they achieve persistence") is not actionable.
  • Procedures change faster than techniques. An actor switches from procdump to a custom LSASS dumper; the technique (T1003.001) and the data source (process access) are unchanged. Detect at the technique level, enrich at the procedure level.
  • Shared tooling blurs attribution. Cobalt Strike and Mimikatz are used by dozens of groups; attribution rests on the combination and sequencing of TTPs, not on one tool.