What is TTPs?

The TTP framework originates from military intelligence doctrine and was adapted for cybersecurity through MITRE and the broader threat intel community. Tactics represent the adversary's high-level goal at a given point in the attack (Initial Access, Privilege Escalation, Lateral Movement, Exfiltration). Techniques describe the general method used to achieve that goal (spearphishing attachment, pass-the-hash, DNS tunneling for exfiltration). Procedures are the specific implementation details observed in one campaign or by one actor (the exact phishing lure text, the specific LOLBin invoked, the particular C2 framework's default beacon interval).

This hierarchy maps directly onto the MITRE ATT&CK framework, which organizes thousands of documented adversary behaviors into a matrix of tactics (columns) and techniques (rows), each technique further broken into sub-techniques with real-world procedure examples pulled from public incident reporting. A single technique, T1055 Process Injection, covers dozens of different procedures across different malware families, all sharing the same underlying behavioral signature: code running inside another process's memory space rather than its own.

TTPs matter for threat intelligence because they are far more durable than IOCs. An actor can rotate C2 IP addresses in minutes and recompile malware to generate a new hash in seconds, but retooling an entire operational workflow, the initial access method, the persistence mechanism, the lateral movement tooling, takes real engineering effort and often campaign-level planning. This is why threat groups get tracked by TTP overlap even when every individual IOC across two campaigns is different: the same actor tends to reuse the same procedures because they work and because building new tradecraft is expensive.

Security teams use TTP knowledge in two directions. Defensively, they map detection coverage against the ATT&CK matrix to find gaps: if your SIEM has zero rules covering any Credential Access technique, that's a visibility hole regardless of how many IOC feeds you subscribe to. From a threat intel perspective, they profile specific actors by the TTPs observed across incidents attributed to them, then prioritize defenses against the techniques used by groups known to target their industry or region.