Tactics Techniques and Procedures

Tactics Techniques and Procedures — A threat-intelligence model describing an adversary's strategic objectives, operational methods, and concrete execution patterns.

Security Context

Tactics, techniques, and procedures describe adversary goals, operational methods, and concrete patterns of execution. TTP-oriented analysis can remain useful after transient indicators such as hashes or IP addresses have changed, which makes it valuable for detection engineering and threat hunting.

Attribution Boundary

Observing a technique is not sufficient to attribute activity to one actor. Different groups can use the same tooling and methods, so attribution requires broader evidence.

Related Security Concepts

• Indicator of Compromise
• Threat Hunting
• Detection Engineering
• MITRE ATT&CK