Indicators of compromise are concrete artifacts observed in a known attack, such as IP addresses, hashes, domains, or suspicious emails. Tactics, techniques, and procedures describe the method and behavior behind the attack. IOCs are useful for confirmation, while TTPs help defenders understand recurring adversary patterns and build more resilient controls.
How IOCs and TTPs differ in practice
Indicators of compromise are evidence artifacts, so they tell you what was observed. Tactics, techniques, and procedures describe adversary behaviour, so they tell you how the activity was carried out. That difference matters because IOC matching is usually confirmatory and time-bound, while TTP analysis helps you recognise repeatable patterns, even when the attacker changes tools or infrastructure.
IOCs are strongest when you already have a suspected event and need to validate it quickly. TTPs are stronger when you are trying to understand whether the intrusion was opportunistic, how the actor moved through the environment, and what controls could stop the same method next time. A hash or domain can disappear; a technique like credential harvesting or privilege escalation tends to recur.
For defenders, the practical distinction is that IOCs are usually more brittle and specific, while TTPs are more durable and generalisable. That is why many security teams use IOCs for triage and containment, then pivot to TTPs for hunting, detection engineering, and control improvement. The most useful programs connect the two instead of treating them as competing concepts.
To see how this plays out in real compromise reporting, consider the difference between a leaked token, a malicious domain, or a suspicious email versus the underlying sequence of access, abuse, and lateral movement that produced them. One is a clue; the other is the playbook. That playbook is often what you need to reduce repeat exposure across the environment, especially when a single identity compromise can be reused across systems.
When you want a deeper account of how credential abuse, service account compromise, and repeatable attacker behaviour show up in real incidents, NHIMG’s The 52 NHI breaches Report is a useful case study set. For broader context on how compromised credentials and privilege abuse drive attack progression, see MITRE ATT&CK Enterprise Matrix.
Why the distinction matters to detection and response
IOC-driven detection works best when the evidence is fresh, specific, and high confidence. The downside is that it can miss the same attacker if they change infrastructure, repackage malware, or shift from one account to another. TTP-driven detection is more resilient because it looks for behaviour, sequence, and intent rather than a single known artifact.
This is also why mature response teams avoid overfitting detections to one breach. If a control only catches yesterday’s file hash or yesterday’s domain, it may give a false sense of coverage. If a control is built around the technique, such as unusual authentication patterns, unexpected privilege use, or abnormal access paths, it can still fire when the specific IOC has already changed.
That said, TTPs are not a replacement for IOCs. IOCs still matter for scoping, eradication, and retrospective searches across logs, endpoints, cloud services, and email. The best operational model is layered: use IOCs to confirm and contain, then use TTPs to generalise the lesson into future detections and preventive controls.
If you are mapping the difference to control work, the key judgement is whether you need short-term proof or long-term resilience. IOCs support the first. TTPs support the second. Both belong in incident handling, but they answer different operational questions and should not be measured with the same success criteria.
MITRE ATLAS adversarial AI threat matrix is useful when you want a structured model of adversary behaviour, and NIST Cybersecurity Framework 2.0 helps place detection, response, and recovery into a broader security program.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TTPs — Tactics, Techniques, and Procedures | ATT&CK directly models adversary behavior and recurring attack patterns behind IOCs. |
| Recommendation — Map observed artifacts to ATT&CK techniques and hunt for the underlying behavior across telemetry. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | IOC and TTP use both support ongoing monitoring and threat detection outcomes. |
| RS.AN — Incident Analysis | Separating artifacts from attack methods improves incident analysis and scoping. | |
| Recommendation — Tune monitoring to catch both known indicators and behavior-based detections. Analyze alerts to distinguish confirmatory indicators from repeatable attack techniques. | ||
| CIS Controls v8 | 8 — Audit Log Management | Logs are the main source for both IOC confirmation and TTP behavior analysis. |
| 13 — Network Monitoring and Defense | Network telemetry helps validate IOCs and reveal recurring attacker techniques. | |
| Recommendation — Centralize and retain logs so you can correlate IOCs with adversary actions. Correlate network activity with known indicators and behavior patterns. | ||
Practitioner Guidance
What to prioritise: Use IOCs for immediate scoping and containment, but do not stop at blocking the artifact. The real value comes from identifying the underlying technique so you can decide whether the same attack path exists elsewhere in the environment.
What to verify: Confirm whether a detection is artifact-based or behaviour-based. If your rule depends on a single hash, domain, or IP, treat it as a narrow signal; if it detects anomalous access, suspicious sequence, or privilege abuse, it is more likely to survive attacker adaptation.
Common mistake: Teams often declare victory after adding more IOC feeds. That improves visibility, but it does not automatically improve resilience if detections do not generalise to the adversary method behind the artifact.
Practitioner takeaway: The strongest programs use IOCs to answer “is this the same event?” and TTPs to answer “how do we stop this class of attack from working again?”
Related resources from NHI Mgmt Group
- What is the difference between indicators of compromise and indicators of attack?
- What is the difference between prompt techniques and tactics in adversarial prompt engineering?
- What is the difference between sharing indicators of compromise and sharing incident response playbooks?
- What is the difference between tactics and techniques in the MITRE ATT&CK framework?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
