Tactics, Techniques And Procedures (TTPs).

What are tactics, techniques and procedures?

Tactics, techniques and procedures, often shortened to TTPs, describe how an attacker behaves. NIST defines a TTP as the behavior of an actor. It splits that behavior into three levels, from broad to detailed.

How do the three levels work?

NIST says a tactic is the highest-level description of the behavior. Techniques give a more detailed description of behavior in the context of a tactic. Procedures are an even lower-level, highly detailed description in the context of a technique.

• Tactic: the goal. MITRE ATT&CK calls it the “why”, the adversary’s tactical goal and the reason for performing an action.
• Technique: the method. MITRE describes it as the “how”, the way an adversary reaches a tactical goal.
• Procedure: the specific implementation. MITRE says procedures are the specific implementation the adversary uses for techniques or sub-techniques.

What does a tactic look like in practice?

MITRE ATT&CK lists tactics for enterprise environments. Here are a few, with the descriptions MITRE gives.

• Reconnaissance: the adversary is trying to gather information they can use to plan future operations.
• Initial Access: the adversary is trying to get into your network.
• Persistence: the adversary is trying to maintain their foothold.
• Credential Access: the adversary is trying to steal account names and passwords.

As a simple illustration, “get into the network” is a goal, so it is a tactic. The different ways to reach that goal are techniques. How one attacker actually carried it out is a procedure.

How do procedures differ from sub-techniques?

MITRE says sub-techniques and procedures describe different things in ATT&CK. Sub-techniques are used to categorize behavior. Procedures are used to describe in-the-wild use of techniques, which means real activity seen in the world.

Why do defenders track TTPs?

TTPs describe behavior, so they give defenders a common way to talk about what an attacker does and why. NIST and MITRE both use the same three-level idea, which can help teams compare reports and describe activity in the same terms. This is general reasoning, not a claim from a single source.

How do TTPs relate to nearby terms?

TTPs are a way to describe attacker behavior, and MITRE ATT&CK is a public knowledge base that organizes them into tactics and techniques. An indicator of compromise is a different kind of clue, covered on its own page.

Is a TTP the same as an indicator of compromise?

No. A TTP describes behavior, meaning what an actor does and how. An indicator of compromise is a specific clue that something may have happened. The two terms answer different questions, and teams often use them together.

Is a tactic the same as a technique?

No. A tactic is the goal, the “why”. A technique is the method, the “how”. One tactic can be reached through different techniques, so ATT&CK keeps the two levels apart.

Is the plural or the abbreviation different?

No. TTP is the short form of one tactic, technique and procedure, and TTPs is the plural. People use both for the same idea.