Security Operations · Intermediate

Tactics, Techniques and Procedures (TTP)

The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.

Definition

TTPs describe how adversaries operate and are more durable than indicators. In MITRE ATT&CK, a tactic is the "why" (e.g., Credential Access), a technique the "how" (e.g., OS Credential Dumping) and a procedure the specific way a group does it (e.g., using Mimikatz sekurlsa::logonpasswords).

Related terms