Tactics, Techniques, and Procedures

How Tactics, Techniques, and Procedures Work

Tactics, techniques, and procedures, or TTPs, describe an adversary’s operating model at three different levels. Tactics are the objective, techniques are the general method used to pursue it, and procedures are the specific steps or tooling an actor applies in a real operation. This layered view is useful because it separates intent from execution.

That distinction matters in threat analysis. A tactic such as credential access can recur across many campaigns, while the exact procedure, such as a phishing kit, token replay workflow, or living-off-the-land command sequence, may change often. In practice, TTPs help analysts reason about behaviour even when indicators like domains, hashes, or IPs have already expired.

Why TTPs Matter in Threat Intelligence

TTPs are more durable than artifacts because they reflect tradecraft rather than infrastructure. A defender may lose sight of one malicious server, but the same technique can reappear across different operations, operators, and tooling. That makes TTPs especially valuable for prioritising detections, building hunt hypotheses, and comparing campaigns at the level of attacker behaviour.

They also create a common language between intelligence, detection engineering, and incident response. When a report says an actor used a technique instead of only naming an artifact, teams can map the behaviour to known adversary patterns and ask whether their own environment shows the same sequence, dependencies, or signs of progression.

For readers who want the canonical ATT&CK reference point, the MITRE ATT&CK Enterprise Matrix is the most direct public catalogue of adversary tactics and techniques.

How Analysts Use TTPs to Hunt and Detect

TTPs support detection engineering because they point to patterns that are harder for adversaries to swap out quickly. A hunt can look for the method, not just the artifact, such as repeated authentication abuse, suspicious command sequences, or a characteristic chain of post-compromise actions. That approach is often more resilient than a signature built around one malware sample or one domain.

TTP mapping also helps teams separate noise from meaningful activity. A single event may look benign, but when it aligns with a known adversary technique and appears in the right sequence, it becomes a stronger signal. This is why TTPs are frequently used in threat models, purple teaming, and control validation.

The same logic applies to defensive countermeasures. Mapping behaviour to a known technique can help responders choose the most relevant mitigation, rather than reacting only to the last observed indicator. The MITRE D3FEND knowledge graph is useful for connecting offensive techniques to defensive measures, while the Pyramid of Pain Guide explains why focusing on TTPs increases pressure on attackers.

TTPs in Real-World Adversary Analysis

TTPs are especially useful when attackers adapt quickly. The same tactic can be implemented through many procedures, so defenders should expect variation in tooling, infrastructure, and timing while still seeing the same core method. That is why TTP analysis works well across phishing, privilege escalation, lateral movement, and persistence campaigns.

In mature operations, analysts use TTPs to compare one event against another, determine whether separate incidents are likely related, and infer whether an adversary is reusing tradecraft. If the same procedures recur across environments, it can indicate a shared playbook, common operator habits, or a repeatable intrusion pattern even when obvious artifacts differ.

For a focused example of technique-level analysis, the Top 10 Phishing Techniques shows how the same high-level objective can be executed through many distinct methods, each with different detection and control implications.

Risk and Threat Considerations

TTPs are not themselves the attack, but they are the lens through which attack capability becomes visible. If organisations only track indicators and not behaviour, they may miss repeatable tradecraft that survives infrastructure changes, credential resets, or malware retooling. That creates a detection gap that adversaries can exploit to stay persistent and blend in.

Failure mechanism: Defenders overfocus on ephemeral artifacts and underweight the recurring methods that survive across campaigns, which lets adversaries reuse the same operating pattern with new infrastructure or payloads.

Impact: Persistence, recurrence, and campaign linkage become harder to detect, which increases the chance of missed intrusions, delayed containment, and repeated compromise.

Practitioner Guidance

Why practitioners should care: Use TTPs as the organising layer for detection and hunting because they describe what an adversary does, not just what it left behind. That makes them more stable for control design, incident triage, and cross-case comparison than one-off artifacts.

Practitioner takeaway: If your detection strategy cannot survive changes in domains, hashes, or payloads, you are probably still measuring artifacts instead of tradecraft.

Related resources from NHI Mgmt Group

• What is the difference between indicators of compromise and tactics, techniques, and procedures?
• Adversary Tactics, Techniques, and Procedures (TTPs)
• What is the difference between prompt techniques and tactics in adversarial prompt engineering?
• What is the difference between tactics and techniques in the MITRE ATT&CK framework?