Simple definition
Tactics, Techniques, and Procedures; a way to describe attacker behavior and operational patterns.
TTPs are valuable because behavior often remains useful for detection after static indicators such as IP addresses, domains, or hashes change.
What are the parts of a TTP?
Tactic
The adversary's high-level objective or reason for acting.
Technique
The method used to achieve the tactical objective.
Procedure
The specific implementation observed in an actor, tool, campaign, or incident.
Telemetry
The evidence that can reveal the behavior in an environment.
Detection
The analytic used to identify or investigate the behavior.
Response
The triage, containment, and remediation actions associated with the behavior.
Why TTPs matter
- Static indicators can change quickly, while attacker behaviors may remain useful for longer periods.
- TTPs give threat intelligence and detection engineering a shared language.
- Behavior-based hunting can search for techniques even when exact infrastructure is unknown.
- Incident responders can compare observed activity with known adversary operating patterns.
- Purple teams can emulate TTPs and validate whether defenses identify them.
- TTP labels are most valuable when connected to real evidence and telemetry.
How TTP analysis works
Collect behavior evidence
Start from incidents, malware analysis, threat reports, or emulation.
Identify the tactic
Determine the adversary objective represented by the activity.
Map the technique
Describe the method used to achieve that objective.
Document the procedure
Capture the concrete commands, tools, infrastructure, sequence, or implementation observed.
Translate to defense
Identify telemetry, detections, hunts, and response actions.
Validate and update
Test the analytics and refresh the TTP as attacker procedures change.
TTP analysis principles
Behavior over indicator
Focus on how the attacker operates, not only the infrastructure used.
Evidence
Separate observed procedures from assumptions or generic technique descriptions.
ATT&CK mapping
Use tactics and techniques to organize behavior consistently.
Context
Preserve campaign, malware, actor, target, and timing context.
Validation
Use representative behavior or emulation to test detections.
Lifecycle
Procedures evolve, so TTP documentation and detections require maintenance.
Common TTP cybersecurity use cases
Threat intelligence
Describe adversary operating patterns beyond IOCs.
Detection engineering
Build behavior-based detections from techniques and procedures.
Threat hunting
Search for behavioral patterns associated with relevant threats.
Incident response
Compare observed activity with known TTPs and identify next likely behavior.
Purple teaming
Emulate attacker procedures to validate controls and detections.
Coverage analysis
Identify relevant TTPs with weak telemetry or detection coverage.
TTP vs Tactic vs Technique
| Concept | Primary meaning | Example role |
|---|---|---|
| TTP | Tactics, techniques, and procedures considered together. | Describe a broader attacker operating pattern. |
| Tactic | The high-level adversary objective. | Describe why the attacker is acting. |
| Technique | The method used to achieve the objective. | Describe how the behavior is performed. |
Key technical considerations
Use ATT&CK IDs where applicable
Stable identifiers improve mapping and data exchange.
Preserve procedure detail
Commands, tools, paths, and sequence can be more actionable than technique names alone.
Keep provenance
Record which report, incident, or observation supports the TTP.
Track time
Attacker procedures and infrastructure change, so age matters.
Map telemetry
Document the evidence required to detect each important behavior.
Regression-test analytics
Behavior detections should be validated after data and rule changes.
Benefits and common problems
Benefits
- Behavior-focused threat understanding.
- More durable detections than IOC-only logic.
- Stronger hunting hypotheses.
- Clear ATT&CK and intelligence mapping.
- Useful purple-team and coverage targets.
Common problems
- TTPs are reduced to generic technique labels.
- Procedure details and provenance are lost.
- Behavior is assumed without evidence.
- Detections are not tested against the described procedure.
- TTP intelligence is not refreshed as adversaries change.
How ForshTec helps operationalize TTPs
ForshTec helps security teams translate TTPs into ATT&CK mappings, telemetry requirements, detections, hunts, tests, and incident-response workflows.
- Threat-intelligence integration
- ATT&CK and TT... (3 KB left)