Tactics, Techniques, and Procedures (TTPs)

Tactics, Techniques, and Procedures (TTPs) represent the behavioral patterns and methodologies employed by threat actors during cyberattacks. This framework provides deeper insights into adversary behavior than traditional indicator-based approaches, enabling more resilient defensive strategies.

​

Core Concept

TTPs describe the “how” and “why” behind cyberattacks, offering insights into adversary behavior that persist across campaigns and tool variations. While indicators of compromise (IOCs) like file hashes change rapidly, TTPs represent underlying patterns that remain consistent, making them valuable for threat hunting and detection engineering.

​

TTP Framework Components

Tactics (The “Why”) High-level adversary goals during an operation:

• Initial Access: Gaining entry into target environments
• Persistence: Maintaining access across system restarts
• Privilege Escalation: Obtaining higher-level permissions
• Defense Evasion: Avoiding detection by security tools
• Lateral Movement: Expanding access across networks
• Data Exfiltration: Stealing valuable information

Techniques (The “How”) Specific methods used to achieve tactical objectives:

• Spearphishing attachments for initial access
• PowerShell execution for legitimate tool abuse
• Registry modification for persistence
• Credential dumping for privilege escalation
• Remote desktop protocol for lateral movement
• DNS tunneling for data exfiltration

Procedures (The “Specific Implementation”) Exact steps, tools, and configurations used by particular threat actors:

• Specific PowerShell commands and parameters
• Custom-compiled versions of public tools
• Unique operational security practices
• Specialized evasion techniques and tool modifications

The MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) framework is the industry-standard knowledge base for understanding and categorizing TTPs. It provides a comprehensive matrix that maps real-world adversary behaviors across the attack lifecycle.

​

Framework Structure

MITRE ATT&CK organizes TTPs into a matrix format with tactics as columns and techniques as rows. This structure allows analysts to understand both what adversaries are trying to achieve (tactics) and how they’re achieving it (techniques).

​

The MITRE ATT&CK Framework

MITRE ATT&CK is the industry-standard framework for understanding TTPs, providing a comprehensive matrix of adversary tactics and techniques based on real-world observations. The framework includes: Enterprise Matrix Techniques used against enterprise IT environments including Windows, Linux, macOS, and cloud platforms. Mobile Matrix Techniques targeting mobile devices and applications. ICS Matrix Techniques focused on industrial control systems and operational technology. Sub-techniques Granular details for specific technique implementations and variations.

​

Defensive Applications

Detection Engineering

• Behavior-based detection rules focused on technique patterns
• Hunt hypothesis development based on known adversary techniques
• Detection gap analysis using ATT&CK technique mapping
• Resilient detections that survive tool changes and evasion

Threat Intelligence Integration

• Campaign attribution through TTP pattern analysis
• Threat landscape understanding and trending technique identification
• Industry-specific threat pattern mapping
• Predictive analysis based on adversary behavior evolution

Security Architecture Planning

• Control mapping to evaluate defensive capabilities
• Security investment prioritization based on TTP coverage
• Purple team exercise design using realistic attack scenarios
• Risk assessment based on relevant threat actor TTPs

​

TTP-Based Detection Strategies

Behavioral Monitoring

• Monitor for suspicious PowerShell execution patterns
• Detect credential dumping through memory analysis
• Identify lateral movement via network traffic analysis
• Flag unusual parent-child process relationships

Pattern Recognition

• Establish baselines of normal system and user behavior
• Identify deviations indicating malicious activity
• Correlate multiple techniques across attack chains
• Track technique sequences indicating specific threat actors

Hunt Development

• Create hunting hypotheses based on relevant TTPs
• Develop playbooks mapping detection capabilities to techniques
• Prioritize hunting activities based on environmental risks
• Focus on high-impact techniques with low current coverage

​

Threat Actor TTP Patterns

Advanced Persistent Threats (APTs)

• Emphasis on stealth and long-term access
• Sophisticated evasion techniques and custom tools
• Heavy focus on credential theft and lateral movement
• Patient approach with minimal operational footprint

Cybercriminal Groups

• Prioritize speed and financial gain over stealth
• Use commodity tools and techniques for efficiency
• Focus on rapid data theft and ransomware deployment
• Optimize operations for maximum revenue generation

Nation-State Actors

• Demonstrate advanced technical capabilities
• Frequent use of zero-day exploits and custom tools
• Target strategic intelligence and critical infrastructure
• Reflect broader geopolitical objectives and timelines

​

Implementation Framework

Assessment and Gap Analysis

• Map existing security controls to ATT&CK techniques
• Identify detection and prevention coverage gaps
• Assess defensive capabilities across attack lifecycle
• Prioritize improvements based on risk and threat relevance

SOC Operations Enhancement

• Train analysts on common TTPs and investigation techniques
• Develop TTP-based investigation playbooks
• Create cross-references between alerts and ATT&CK techniques
• Implement metrics tracking detection coverage and effectiveness

Detection Rule Development

• Focus on behavior patterns rather than specific indicators
• Create rules that detect technique implementations
• Build resilient detections that survive evasion attempts
• Validate rules against known attack scenarios

​

Challenges and Considerations

TTP Evolution

• Adversaries continuously adapt techniques to evade detection
• New techniques emerge that may not be covered by existing defenses
• Living-off-the-land attacks increase use of legitimate tools
• Detection requires constant adaptation and improvement

Operational Challenges

• Behavior-based detection can generate significant false positives
• TTPs often require multiple data sources for accurate detection
• Some techniques are only observable during specific timeframes
• Context and correlation are essential for effective implementation

Organizational Requirements

• Teams need training on TTP analysis and detection techniques
• Multiple security tools must provide correlated visibility
• Incident response processes must incorporate TTP analysis
• Continuous learning and adaptation are essential

​

Detection Engineering Examples

Credential Dumping Detection Monitor for unauthorized access to LSASS memory, unusual process relationships with credential stores, and suspicious authentication events indicating credential harvesting. Lateral Movement Detection Identify unusual network connections, unauthorized remote access attempts, and privilege escalation patterns indicating adversary expansion across networks. Command and Control Detection Detect suspicious network communications, unusual DNS queries, and encrypted communication channels that could indicate adversary infrastructure.

​

Future Directions

Automation and Intelligence

• Machine learning models trained on TTP patterns
• Automated TTP extraction from security telemetry
• Real-time adaptation and response based on TTP identification
• Cross-industry collaboration for improved collective defense

Platform Integration

• SOAR platform integration with ATT&CK frameworks
• Threat intelligence platforms with native TTP support
• Security orchestration based on TTP workflows
• Unified visibility across multiple security domains

​

Conclusion

TTPs provide the analytical foundation for modern cybersecurity defense, enabling behavior-focused protection that transcends indicator-based approaches. Understanding adversary tactics, techniques, and procedures allows security teams to build resilient defenses that adapt to evolving threats while providing deeper insights into attack patterns and attribution. Effective TTP implementation requires systematic analysis, continuous learning, and organizational commitment to behavior-based security. Organizations that master TTP-focused defense strategies gain significant advantages in threat detection, incident response, and strategic security planning, positioning themselves to effectively counter sophisticated adversaries in an evolving threat landscape.