Threat Actor Tactics, Techniques, and Procedures (TTPs)

What TTPs Tell You About an Adversary

TTPs are most useful when you read them as attacker behaviour, not as isolated indicators. They describe how a threat actor enters, moves, persists, and completes objectives, which helps defenders understand the operating pattern behind an incident, not just the artefact left behind.

That is why TTP analysis supports both detection engineering and threat intelligence. A single hash or domain may disappear quickly, but a repeated intrusion pattern, such as the same privilege escalation path or the same exfiltration workflow, is far more durable and more useful for defence.

Tactics, Techniques, and Procedures in Practice

Tactics are the broad goals of an intrusion, such as initial access, credential access, persistence, privilege escalation, or exfiltration. They answer the question, “why is the attacker doing this step?”

Techniques are the methods used to achieve those goals, such as phishing, token theft, remote service abuse, or scheduled task creation. They answer the question, “how is the attacker doing it?”

Procedures are the concrete implementation details observed in a specific campaign or incident, including the exact tool, command sequence, lure, or infrastructure choice. They answer the question, “what did this actor do in this case?”

Why TTPs Matter for Detection and Hunting

TTPs matter because they are closer to attacker intent and tradecraft than simple indicators. Once you know which behaviours an adversary prefers, you can design detections around movement, privilege abuse, and persistence instead of waiting for a known bad file or IP address to reappear.

Good TTP analysis also helps defenders cluster related activity. Two incidents may look unrelated at the indicator level, but if they share the same authentication abuse, same lateral movement pattern, or same exfiltration workflow, they may belong to the same actor, toolchain, or campaign family.

This is why the Pyramid of Pain Guide is a useful companion concept: it explains why behavioural patterns such as TTPs are harder for attackers to change than atomic indicators like hashes or IPs.

The same logic underpins the MITRE ATT&CK Enterprise Matrix, which gives defenders a shared vocabulary for mapping observed behaviour to tactics and techniques.

TTPs in Threat Intelligence and Actor Analysis

TTPs are a core part of threat intelligence because they let analysts describe not only who may be responsible, but also how that adversary tends to operate. That behavioural profile becomes more valuable over time, especially when the same actor reuses infrastructure, tooling habits, or access methods across multiple campaigns.

They also help teams avoid overfitting to a single incident. A procedure can change quickly, but the underlying technique or tactic may remain stable, so analysts need to separate what is durable from what is merely campaign-specific.

When analyst reporting focuses on repeatable behaviour, it becomes easier to compare campaigns, prioritise detections, and communicate risk across teams. For broader context on how groups are named and tracked, see the Threat Actor Groups Guide and the Cyber Threat Attribution Guide.

Risk and Threat Considerations

TTPs become dangerous when they are understood too late, because the attacker has already progressed from access to persistence, lateral movement, and impact. The main risk is not the label itself, but the way repeated tradecraft can bypass point-in-time controls and blend into normal operational activity.

Failure mechanism: Defenders focus on static indicators or narrow incident artefacts while the attacker reuses the same behavioural pattern across new hosts, accounts, or sessions, allowing the intrusion to continue even after one payload or infrastructure element is blocked.

Impact: Missed behavioural detection increases the chance of follow-on compromise, including privilege escalation, deeper internal movement, credential abuse, and exfiltration that survives initial containment efforts.

Related resources from NHI Mgmt Group

• Tactics, Techniques, and Procedures
• Adversary Tactics, Techniques, and Procedures (TTPs)
• What is the difference between indicators of compromise and tactics, techniques, and procedures?
• What tactics and techniques does Threat Group-1314 use?