TTPs in Cybersecurity: Tactics, Techniques, and Procedures

Tactics, techniques, and procedures (TTPs) describe the goal behind an attacker's action, the method used to reach it, and the specific way a particular actor carried it out. They describe behavior, and behavior usually changes more slowly than indicators of compromise (IOCs) such as hashes, IP addresses, and domains.

A clean sweep of an advisory's indicators rules out matches to those exact artifacts in the telemetry searched. The actor may still be in the environment with a rebuilt payload and fresh infrastructure. A TTP-based detection or hunt looks for the behavior itself, such as dumping LSASS memory, creating a backstopped identity, or turning a help desk password reset into administrator access.

This guide covers what each level means, how they fit into MITRE ATT&CK, why behavior-based detection tends to outlast indicators, where it breaks, and how to turn a technique into a hunt.

TL;DR:

• TTPs describe attacker behavior at three levels: the tactic is the goal, the technique is the method, and the procedure is one actor's specific implementation.
• MITRE ATT&CK gives teams a shared vocabulary for TTPs, but tagging a rule with a technique ID doesn't prove the rule catches that behavior.
• Behavior-based detection and hunting tend to outlast indicator matching because attackers can swap hashes and infrastructure cheaply, while changing how they operate takes retooling.
• TTP-based programs often fail at the procedure level, where implementation variants, legitimate admin activity, and missing telemetry open gaps that coverage heatmaps hide.
• Most programs need both: IOC sweeps for fast scoping after an advisory, and behavior-based hunts and detections for intrusions that leave no indicators to match.

What TTPs Mean in Cybersecurity

NIST's glossary defines TTPs as the behavior of an actor, described at three levels of detail from the tactic down to the procedure. MITRE ATT&CK uses the same levels and adds the sub-technique between technique and procedure.

Tactics, Techniques, and Procedures in One Chain

In ATT&CK, Credential Access is the tactic, the reason the adversary acts. OS Credential Dumping (T1003) is the technique, or method. LSASS Memory (T1003.001) is one sub-technique.

The procedure is the specific implementation: APT28 has deployed Mimikatz and custom password retrieval tools against victims and dumped LSASS process memory with the MiniDump function.

The labels themselves aren't used consistently. CISA's federal incident response playbooks, published in November 2021, call techniques the what and procedures the how. CISA's ATT&CK mapping guide, updated in January 2023, calls procedures the what, and ATT&CK itself calls techniques the how.

Mismatched labels like these can leave threat intelligence analysts and detection engineers talking past each other, so use ATT&CK's definitions and document them.

How TTPs Map to MITRE ATT&CK

MITRE started ATT&CK in 2013 to document the TTPs advanced persistent threats used against Windows enterprise networks. It has since grown into a knowledge base of adversary behavior built from real-world observations. The current release, ATT&CK v20, came out on October 13, 2026, and lists 15 tactics, 227 techniques, and 479 sub-techniques in Enterprise ATT&CK.

In October 2025, ATT&CK v18 replaced the detection text on each technique page with Detection Strategies, which point to analytics and the data components they depend on. It also deprecated Data Sources.

ATT&CK v19 split Defense Evasion into Stealth and Defense Impairment in April 2026. Stealth kept the old tactic ID, TA0005, so older rules tagged with it now point to Stealth. The release also replaced Impair Defenses with new Defense Impairment techniques such as Disable or Modify Tools. Rules covering impairment behavior need those new technique IDs as well as the new tactic.

Mapping a threat report onto technique IDs takes judgment, and choosing the right technique or sub-technique is often the hardest part.

Why TTP-Based Detection and Hunting Outlast IOCs

Changing behavior costs an adversary more than changing artifacts. A new hash takes a recompile and a new command-and-control address takes new infrastructure, but a new way of stealing credentials or moving laterally takes retooling and practice.

The Pyramid of Pain ranks indicators by that cost, with hashes and IP addresses near the bottom and TTPs at the top. MITRE's Center for Threat-Informed Defense (CTID) builds on that ranking in its Summiting the Pyramid model.

In Microsoft's 2026 reporting, Storm-2570 kept largely the same tradecraft across deployments of Qilin, DragonForce, Anubis, and BERT ransomware. Tracking attacks by payload alone can hide the recurring behavior defenders need to detect and stop them. In a separate Photo ZIP campaign, an unattributed actor repeatedly reworked its PowerShell obfuscation, but the underlying logic stayed the same. Microsoft read the rework as an effort to survive static detections.

UNC3944, which overlaps with Scattered Spider, has kept consistent core tactics that don't rely on software exploits, centered on calling IT help desks to get passwords reset. In CrowdStrike's 2026 Global Threat Report, 82% of detections in 2025 were malware-free, and intrusions without malware leave few file indicators to match.

Behavior still changes. CISA's July 2025 update says Scattered Spider keeps some TTPs consistent and often changes others to remain undetected. Red Canary, now part of Zscaler, split Scarlet Goldfinch's 2025 activity into six epochs with little to no overlap in behavioral detection coverage between them. Tracking the group's infrastructure tied the epochs together.

In a 2025 SANS analysis of three actors, file hashes persisted far longer than domains, contrary to what the Pyramid of Pain assumes. The durability case is qualitative, so treat it as a tendency and keep tracking infrastructure as well.

Real TTP Examples Mapped to ATT&CK

CISA's joint advisories pair reported procedures with technique IDs and make a practical source of real examples.

‍

Several rows describe identity and cloud behavior that an IOC feed would struggle to express at all.

Where TTP-Based Detection Breaks

Gaps open between a technique on a coverage map and the ways attackers carry it out. Each of the following can make that map look healthy while intrusions go unseen.

Procedure Variation

A rule written against one implementation of a technique can miss the others. The 144 Sigma analytics CTID evaluated on Windows Security logs covered about 26.8% of the implementations of the 84 techniques they mapped to.

An implementation is one behaviorally distinct way to perform a technique. The detection chokepoints project, a community database of attack prerequisites, tracks 24 variants of LSASS credential access alone, each a different tool or method aimed at the same process.

Benign Overlap With Admin Activity

Many attackers use the same tools administrators do, and living off the land is a hallmark of Volt Typhoon. In Red Canary's process injection data, rules that looked for CreateRemoteThread calls produced the most false positives, because many Windows tools inject into processes legitimately for debugging and virtualization.

Missing Telemetry

Behavioral detection needs process, identity, and cloud audit data that many environments don't collect or keep. Intrusions involving the BRICKSTORM backdoor averaged 393 days of dwell time in M-Trends 2026, well past standard 90-day log retention, and the backdoor runs on network appliances that don't support EDR.

Tag-Based Coverage Claims

Technique tags are judgment calls, and detection rulesets disagree on them. Four endpoint rulesets collected in 2022 completely disagreed on technique annotations 51% of the time and fully agreed only 2.7% of the time. A green cell on one product's coverage heatmap can mean something different from the same green cell on another's.

How to Turn a TTP Into a Threat Hunt

Splunk's PEAK framework organizes a hunt into Prepare, Execute, and Act phases, and a hypothesis-driven TTP hunt fits inside them. Select a technique, write a testable hypothesis, confirm the telemetry exists, run the logic, and record the result. Don't skip the telemetry check because a hunt against data you don't collect can't prove anything either way.

For LSASS credential access (T1003.001), the hypothesis is that a non-allowlisted process on a domain controller or other high-value server opened a handle to lsass.exe with memory-read rights. The required telemetry is Sysmon Event ID 10 (ProcessAccess) or an EDR equivalent, with the GrantedAccess and CallTrace fields populated.

The logic looks for non-system processes that open lsass.exe with credential-dump access masks. Splunk's detection keys on GrantedAccess 0x1010 and 0x1410, and the chokepoints project's rule adds masks such as the full-access 0x1FFFFF.

Before turning its research baseline into a hunting rule, the project recommends running it for one week to build an environment-specific allowlist of legitimate LSASS accessors.

In PEAK's Act phase, a result worth catching again becomes a production rule if it's reliable enough to alert an analyst. The team then doesn't have to re-hunt it.

Choosing Between IOC and TTP Approaches

IOC matching and TTP work fit different situations, and the right mix depends on what the threat in front of you leaves behind:

• If an advisory just published fresh indicators, run an IOC sweep first for fast scoping.
• If a new threat is likely to be short-lived, an indicator rule is a fast stopgap.
• If your priority actors rely on help desk social engineering or valid accounts, hunt identity behaviors such as an MFA reset followed by new device enrollment.
• If a technique requires telemetry you don't collect, fix the collection before writing the rule.
• If a behavioral rule is too noisy, add scoped filters and context so it can stay on. Red Canary, for example, runs a suppression engine that filters known benign activity.

Together, these choices keep IOC matching for speed and put most engineering hours into behaviors.

Why Hypothesis Hunts Are Hard to Sustain

Each hypothesis hunt needs someone to frame the hypothesis, write queries across several data sources, iterate on the results, and decide what they mean. As a result, programs often run hunts episodically and leave much of the environment untested between them. The gap matters because hypothesis hunts find TTPs that existing detections miss.

AI agents can take on much of the query-and-iterate work, and with a human checking the output, a continuous cadence becomes realistic. Developing the hypothesis still relies primarily on human expertise and deep organizational context.

Daylight runs its threat hunting on this split: a security expert defines the hypothesis, and specialized AI agents test it across up to 90 days of telemetry. Each hunt ends with either an explanation of all activity or escalation of unexplained behavior into a full investigation and converted detections.

Frequently Asked Questions About TTPs in Cybersecurity

Is a Sub-Technique the Same as a Procedure?

No. A sub-technique categorizes behavior that many groups share, and a procedure records how one group or piece of software used a technique in the wild. When you map a threat report, CISA's guidance is to use the parent technique only when the report lacks the detail to identify the sub-technique.

How Do Security Teams Learn an Adversary's TTPs?

Mostly from threat intelligence and their own investigations. ATT&CK's group pages collect documented procedures for named actors, and vendor and government threat reports describe current campaigns. Incidents and hunts in your own environment add the procedures most relevant to you, because they show how an actor behaved against your systems.

How Should We Report ATT&CK Coverage to Leadership?

Report visibility and detection quality as separate scores for each technique, the way the open-source DeTT&CT framework does, and note which implementations of a technique each rule covers. A single covered or not-covered mark per technique hides the implementations your rules miss.

Does ATT&CK v20 Include Detection Strategies for Prompt Injection?

No. ATT&CK v20 added Direct Prompt Injection and Indirect Prompt Injection as Execution techniques, and neither technique page lists a detection strategy. The release does add detection strategies for other AI behaviors, including AI-enabled exfiltration and AI result poisoning. Teams that want to hunt prompt injection will need to write their own analytics for now.

Can an LLM Reliably Write TTP Hunt Queries?

It can help, but it can't be trusted to get a query right on its own. An LLM may write logic that looks correct but uses the wrong field names, allowlists too much, or misses an implementation variant of the technique. An analyst should check every generated query against the hunt hypothesis and test it on real telemetry before relying on its results.