Understanding TTPs
In cyber security, understanding how attackers operate is just as important as knowing what they target. This is where TTPs — Tactics, Techniques, and Procedures — come into play.
Security teams use TTPs to break down and categorize attacker behavior into identifiable and repeatable patterns. Let’s unpack what that means and why it’s central to effective incident response, threat hunting, and intelligence operations.
🔍 What Are TTPs?
TTP stands for:
Tactics – the why behind an attacker’s actions. It defines the goal or objective (e.g., initial access, persistence, lateral movement).
Techniques – the how an attacker achieves that goal. For instance, using phishing emails to gain initial access.
Procedures – the exact implementation details or step-by-step execution of the technique. This could be a specific phishing email with a malicious PDF attachment that exploits a macro vulnerability.
Security frameworks like MITRE ATT&CK use TTPs to map adversary behavior to known patterns. This helps defenders recognize threats faster and anticipate the next move.
🧠 Why TTPs Matter
Understanding TTPs allows security teams to:
Behavior over signatures: TTPs focus on attacker behavior, not static indicators like IP addresses or file hashes — which can easily change.
Threat intelligence correlation: MITRE ATT&CK and similar frameworks classify adversary actions by TTPs, enabling standardized reporting and cross-industry sharing.
Detection engineering: SOC teams build detections around TTPs to catch similar attacks, even if the malware or infrastructure changes.
By focusing on the attacker’s playbook, defenders can identify threats earlier in the kill chain and reduce dwell time significantly. Mapping incidents to known TTPs, defenders can proactively hunt for patterns and deploy targeted controls.
🧩 Three TTP Scenarios in Action
Let’s look at how TTPs manifest in real-world scenarios.
Scenario 1: Phishing for Initial Access
Tactic: Initial Access
Technique: Spearphishing Attachment (MITRE ATT&CK: T1566.001)
Procedure: A threat actor sends a targeted email to finance employees disguised as an invoice. The attached Excel sheet contains a malicious macro that downloads a second-stage payload via mshta.exe. Once executed, it establishes a connection to a C2 server hosted on an external VPS.
Defensive Insight: Monitoring for mshta.exe spawning from Office applications and blocking unsigned macros can prevent this attack path.
Scenario 2: Credential Dumping in a Compromised Domain
Tactic: Credential Access
Technique: LSASS Memory Dump (MITRE ATT&CK: T1003.001)
Procedure: After gaining administrative rights, the attacker runs procdump.exe -ma lsass.exe lsass.dmp and exfiltrates the dump file for offline password cracking.
Defensive Insight: Detect anomalous LSASS access, implement Credential Guard, and restrict administrative privileges to prevent this escalation route.
Scenario 3: Data Exfiltration from a Cloud Environment
Tactic: Exfiltration
Technique: Exfiltration to Cloud Storage (MITRE ATT&CK: T1567.002)
Procedure: The attacker leverages compromised AWS credentials to upload sensitive data from an S3 bucket to a newly created external storage account on Dropbox using aws s3 sync commands.
Defensive Insight: Implement strict IAM roles, monitor for new external data transfers, and enable CloudTrail alerts for unauthorized resource creation.
🧱 Final Thoughts
TTPs form the behavioral DNA of cyber adversaries.
Where an IOC (Indicator of Compromise) might change daily, TTPs evolve slowly — making them far more valuable for long-term detection, hunting, and threat modeling.
By learning to recognize and map TTPs, SOC teams can:
Detect new attacks using known behavioral patterns.
Improve incident reports and intelligence sharing.
Engineer proactive controls that stop adversaries before they succeed.
By tracking and analyzing TTPs, SOC analysts, threat hunters, and blue teams can move beyond chasing alerts — instead focusing on attacker intent and methodology. In an age where malware evolves daily, behavioral understanding is the defender’s strongest weapon.