What is the difference between a tactic, a technique and a procedure (TTP)?
They describe an attack at three levels of detail. A tactic is the attacker's goal at a given moment, the why: lateral movement, for example, means getting from one machine to others. A technique is how they achieve it, such as using remote services, and a sub-technique narrows it down further, such as remote desktop or SMB administrative shares. A procedure is the specific way a particular group does it: which tool, which command, in which order. Together they are called TTPs. The distinction matters for defence: blocking a procedure, such as one tool's file hash, is easily evaded, while detecting a technique, such as a workstation suddenly opening administrative sessions to many servers, works whatever tool is used. Network detection works mostly at the technique level, which is why NetSenX alerts name techniques rather than tools.