TTP
Tactics, Techniques, and Procedures
Taktiken, Techniken und Prozeduren
TTP stands for Tactics, Techniques and Procedures — the description of attacker behaviour on three levels: the overarching goal (tactic), the method to get there (technique) and the concrete implementation (procedure). TTPs describe how an attacker works, not merely which tools they use. Precisely for this reason they are so meaningful and hard to fake.
History & facts. The term originally comes from the military domain and has established itself in cybersecurity as a central level of description — above all through MITRE ATT&CK, which systematically catalogues the tactics (the „why“, e.g. initial access, lateral movement) and techniques (the „how“) of real attackers. Important is the „pyramid of pain“: simple indicators such as IP addresses or hashes an attacker can change effortlessly; changing their fundamental behaviour — their TTPs — is, by contrast, laborious and painful for them. Those who detect at the TTP level therefore hit the adversary at their most sensitive point.
Outlook & recommendation. Detection should not rely solely on volatile indicators but increasingly on behaviour — i.e. on TTPs. This makes the defence more robust against small changes on the attackers' part and is the basis for effective threat hunting. In practice it helps to align one's own detection rules and exercises with ATT&CK and thus to check systematically against which techniques one is already visible and where gaps exist.