Simple definition
TTPs describe the tactics, techniques and procedures an actor uses to carry out activity.
Purpose and use
They support behavioral analysis and detections that do not rely only on IP addresses or file hashes.
How does it work?
A tactic expresses an objective, a technique a way to achieve it and a procedure its concrete implementation in a particular context.
Key points
- Example: incidents use different domains but show a similar sequence of credential theft followed by data access.
- Describe observed facts and map them to a technique with sufficient evidence, without automatically inferring the attacker’s identity.
Points to watch
Different actors can share TTPs. Similarity does not establish attribution, and behaviors change over time.
In short
TTPs explain how an actor operates and complement short-lived technical indicators.