TTP-Based Hunting

Expanded Definition

TTP-based hunting is a behaviour-led approach to threat hunting that looks for recurring attacker tactics, techniques, and procedures instead of relying on one-off indicators. It is especially useful when adversaries rotate infrastructure, repackage malware, or change delivery mechanisms while keeping the underlying tradecraft consistent. For NHI Management Group, the key distinction is that TTPs describe how an intrusion is carried out, not just what artefacts it leaves behind.

This makes the method broader than signature-based detection and more durable than hunts built only around IP addresses, file hashes, or domain names. In practice, teams map observed activity to known adversary patterns, then hunt for the conditions that enable those patterns to succeed. That often includes lateral movement, credential misuse, persistence attempts, unusual privilege escalation paths, and suspicious remote execution. The NIST Cybersecurity Framework 2.0 is relevant because it reinforces outcome-driven detection and response discipline that supports this style of hunting.

The most common misapplication is treating any alert review as TTP-based hunting, which occurs when analysts only recheck known indicators without testing whether the attacker’s behaviour pattern is still active.

Examples and Use Cases

Implementing TTP-based hunting rigorously often introduces more analyst workload and deeper telemetry requirements, requiring organisations to weigh detection resilience against tuning and investigation cost.

• A hunt looks for repeated use of legitimate remote administration tools combined with unusual parent-child process chains, a pattern often seen in hands-on-keyboard activity.
• Analysts search for privilege escalation behaviour, such as token manipulation or suspicious service creation, even when the exact malware sample has changed.
• A team reviews patterns of credential access followed by lateral movement to identify possible account compromise across endpoints and identity systems.
• Hunts focus on persistence techniques like scheduled tasks, startup folder abuse, or registry modifications, because those behaviours often survive infrastructure changes.
• Security teams correlate identity logs, endpoint telemetry, and network flows to see whether a known adversary technique is repeating in a new campaign.

These use cases are strongest when analysts already understand the likely adversary model and have telemetry rich enough to observe behaviour, not just outcomes. They are also easier to operationalise when mapped to a shared taxonomy such as MITRE ATT&CK, although ATT&CK is a technique catalogue rather than a formal governance standard.

Why It Matters for Security Teams

TTP-based hunting matters because many intrusions now evade static detections by changing infrastructure faster than defenders can block it. A behaviour-focused model helps teams find active compromise even after hashes expire, domains are sinkholed, or payloads are repacked. It also improves collaboration between threat intelligence, detection engineering, and incident response by giving each group a common language for attacker behaviour.

The identity connection is especially important. When adversaries abuse valid accounts, hijacked service principals, or automation credentials, pure indicator hunting can miss the event entirely. TTP-based hunting helps expose abuse of privileged sessions, abnormal authentication sequences, and non-human identity misuse that may otherwise look legitimate in isolation.

Security teams that lack this discipline often discover the value of behavioural hunting only after repeated alert fatigue or a post-incident review shows the same tradecraft was visible across multiple systems, at which point TTP-based hunting becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do browser-based attacks need different hunting controls than endpoint threats?
• Why do IOCs age out faster than TTP-based hunts?
• How do graph-based methods improve threat hunting prioritisation?
• Why are identity-based attacks growing faster than traditional network attacks?