Glossary
TTP
TTPs describe HOW attackers attack, not just what they used. While malware changes constantly, attack methods stay similar. Understanding TTPs helps you defend against attack patterns, not just specific tools.
What is TTP?
Tactics, Techniques, and Procedures - the patterns of behavior used by threat actors to conduct attacks.
Why Should You Care?
TTPs enable threat intelligence teams to map recurring attack patterns across incidents, allowing your organization to focus defenses on the actual adversary behavior rather than chasing constantly-evolving tools. When you understand that a threat actor always establishes persistence before exfiltration, you can build detection rules around that behavior pattern even as they swap malware families. This shift from tool-focused to behavior-focused defense dramatically improves your chances of stopping an attack in progress.
Is your business exposed?
Real-World Example
APT28, a Russian state-sponsored group, is known for spear-phishing with credential-stealing payloads followed by lateral movement using stolen credentials and exploitation of unpatched systems. Security teams tracking APT28 can recognize this TTP pattern across different campaigns and years—even when the specific malware changes—because the underlying sequence of initial access, credential theft, and lateral movement remains their signature approach.
How to Protect Against TTP
- 1.
Learn TTPs of threats targeting your industry
- 2.
Build detections based on TTPs, not just IOCs
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required