MITRE ATT&CK Techniques, Tactics, and Procedures (TTPs)

What TTPs mean in ATT&CK

MITRE ATT&CK TTPs are the observable behaviours defenders study, not just the malware or tool itself. Tactics describe the attacker’s objective, techniques describe the general approach used to reach it, and procedures describe the specific implementation an intrusion actually used. That structure helps security teams translate raw alerts into adversary behaviour.

Because TTPs sit at the behaviour level, they are useful for comparing one incident to another even when the payload, infrastructure or initial access method changes. A single technique can appear in many campaigns, while procedures reveal how a particular adversary adapted the method to the environment they found.

How tactics, techniques and procedures differ

In ATT&CK, tactics answer the question “why is the attacker doing this now?”, techniques answer “how is the goal being carried out?”, and procedures answer “what did it look like in this intrusion?”. That separation matters because detection and response usually become stronger as teams move from generic alerts to behaviourally specific interpretation.

For example, credential theft, lateral movement and defence evasion are not the same kind of thing. Tactics frame the adversary objective, techniques provide the method family, and procedures show the concrete commands, tools, account abuse patterns or log artefacts seen in the environment.

Why TTPs matter for detection and threat-informed defence

TTPs are especially valuable because indicators at the infrastructure level often disappear or change quickly, while behaviour can remain recognisable. Teams use ATT&CK mapping to organise detections, find coverage gaps and prioritise where telemetry or analytics need improvement.

That makes TTPs a practical bridge between threat intelligence and security operations. If a detection only names a file hash or IP address, it can age out fast; if it maps to a technique, it can remain useful across variants, reloads and retooling. For a defender-oriented mapping approach, see the MITRE ATT&CK Guide for Defenders and the MITRE ATT&CK Enterprise Matrix.

How organisations use TTPs in practice

Practitioners use TTPs to structure detection engineering, incident triage and adversary emulation. The goal is not just to label an alert, but to understand whether the observed behaviour matches a known technique, whether the chain of techniques suggests a broader campaign, and what control or telemetry should have caught it earlier.

TTPs also support better collaboration between threat intelligence, SOC analysts and incident responders. The same technique can be discussed consistently across reports, detections and response playbooks, which reduces ambiguity when multiple teams need to reason about what the attacker actually did.

Risk and Threat Considerations

TTPs are powerful precisely because they describe repeatable attacker behaviour. That also means they can be used to plan, test and refine intrusion paths, especially when an attacker can reuse the same technique against many targets until defenders close the gap.

Failure mechanism: Security teams miss or underweight TTPs when they focus on isolated indicators, incomplete telemetry or one-off signatures instead of the behavioural pattern that links the intrusion together.

Impact: The result is weaker detection, slower investigation and a higher chance that the same adversary behaviour will succeed again through a different tool, account or infrastructure set.

Practitioner Guidance

Why practitioners should care: TTPs become most useful when they are tied to actual detections, not just used as reporting language. Teams should map observed behaviour to techniques that can be validated, hunted and measured over time. The MITRE ATT&CK Detection Strategies and Analytics Guide is useful here because it shows how to turn ATT&CK techniques into tested analytics.

Common misunderstanding: A technique name is not itself a detection. Practitioners still need telemetry, logic and validation that prove the behaviour occurred in their environment rather than merely matching a label.

Practitioner takeaway: Use ATT&CK as a shared behavioural language, then measure whether your detections, hunt queries and response playbooks actually see the technique when it happens.

Related resources from NHI Mgmt Group

• MITRE ATT&CK
• What is the difference between tactics and techniques in the MITRE ATT&CK framework?
• What is the difference between MITRE ATT&CK tactics and techniques in Kubernetes security?
• What is the difference between attack emulation and simply reviewing MITRE ATT&CK techniques on paper?