In the MITRE ATT&CK model, a tactic is the adversary’s goal or reason for an action, a technique is the method used to achieve that goal, and a procedure is a specific implementation observed in real activity.
For example, initial access is a tactic; phishing (T1566) is one technique for achieving it; and a particular campaign’s lure wording, attachment type, and follow-on commands are the procedure. Mapping observations to TTPs gives defenders a shared language for detections, threat reports, exercises, and control testing.
Key points
Primary purposeDescribe adversary behavior in a way that can be compared across incidents and tools.
Defensive useDetection engineering, threat hunting, purple teaming, gap analysis, and incident reporting.
Relative durabilityBehaviors are often more stable than individual domains, addresses, or file hashes, though actors do change them.
Important limitationA TTP match rarely identifies an actor by itself; unrelated groups can use the same tools and techniques.