What are TTPs?

Tactics, techniques and procedures (TTPs) describe how threat actors pursue objectives and carry out attacks. In the MITRE ATT&CK model, a tactic is the adversary’s goal or reason for an action, a technique is the method used to achieve that goal, and a procedure is a specific implementation observed in real activity.

For example, gaining credentials may support a credential-access tactic; phishing is a technique; and a particular campaign’s wording, attachment, and command sequence form part of its procedure. Mapping observations to TTPs gives defenders a shared language for detections, threat reports, exercises, and control testing.