What are TTPs?

TTPs stands for Tactics, Techniques and Procedures: how an attacker works, rather than which file or address they use. A tactic is the goal, such as getting in, staying hidden or stealing data. A technique is a way to reach it, such as stealing passwords or moving between machines with remote tools. Procedures are the specific steps a group uses. The MITRE ATT&CK framework is the common catalogue of these techniques. TTPs matter because attackers change addresses and files easily but change their habits slowly, so detecting behaviour lasts longer than blocking a list of known bad indicators.

← All 69 questions on What is…? Network and security termsAll topics