# What are TTPs?

TTPs stands for Tactics, Techniques and Procedures: how an attacker works, rather than which file or address they use. A tactic is the goal, such as getting in, staying hidden or stealing data. A technique is a way to reach it, such as stealing passwords or moving between machines with remote tools. Procedures are the specific steps a group uses. The MITRE ATT&CK framework is the common catalogue of these techniques. TTPs matter because attackers change addresses and files easily but change their habits slowly, so detecting behaviour lasts longer than blocking a list of known bad indicators.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-are-ttps

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What is threat intelligence?](https://netsenx.com/en/faq/what-is-threat-intelligence)
- [What is an attack surface?](https://netsenx.com/en/faq/what-is-an-attack-surface)
- [What is a threat actor?](https://netsenx.com/en/faq/what-is-a-threat-actor)
- [What is an APT (advanced persistent threat)?](https://netsenx.com/en/faq/what-is-an-apt)
- [What are false positives and false negatives?](https://netsenx.com/en/faq/what-are-false-positives-and-false-negatives)