Explain what TTPs are in the context of threat intelligence. Why are TTPs considered more valuable than simple indicators of compromise for long-term defense?

Question

Accepted Answer

TTPs stands for Tactics, Techniques, and Procedures, which together describe the behavior patterns of cyber adversaries. Understanding TTPs provides deeper insight into how attackers operate than simple indicators like IP addresses or file hashes.

Tactics represent the high-level objectives or goals an adversary is trying to achieve during an attack. These are the strategic purposes behind their actions. Examples include initial access to gain a foothold in the network, persistence to maintain access across reboots, privilege escalation to gain higher-level permissions, defense evasion to avoid detection, credential access to steal authentication material, lateral movement to expand access across systems, collection to gather data of interest, and exfiltration to steal data from the network. The MITRE ATT&CK framework organizes adversary behavior around these tactical objectives.

Techniques describe the specific methods adversaries use to accomplish their tactical objectives. For the tactic of initial access, techniques might include phishing with malicious attachments, exploiting public-facing applications, or using valid compromised accounts. Each technique represents a distinct approach to achieving the same goal. Understanding techniques helps defenders anticipate the various ways an attacker might attempt to achieve each objective.

Procedures are the specific implementations of techniques by particular threat actors. Different groups may use the same technique but with different tools, commands, or variations. For example, two threat groups might both use PowerShell for execution, but one uses encoded commands while another uses specific obfuscation methods. Procedures represent the most granular level of adversary behavior.

TTPs are more valuable than simple indicators for several reasons. Indicators are ephemeral: attackers can change IP addresses, register new domains, and recompile malware with different hashes in minutes. Blocking yesterday's indicators provides no protection against tomorrow's attack using fresh infrastructure. TTPs are more persistent because changing behavior is harder than changing infrastructure. An attacker might easily switch command and control servers, but fundamentally changing how they move laterally or escalate privileges requires significant effort and may not align with their skills or tooling.

Detection based on TTPs catches variants and evolutions of attacks. A detection rule looking for a specific malware hash catches only that exact file, while a detection rule looking for the technique of credential dumping from memory catches any tool that performs that action. TTP-based defenses also transfer across threat actors: different groups using similar techniques can be detected by the same rules.

Building defenses around TTPs requires more effort but provides more durable protection. Organizations should invest in understanding adversary behavior patterns, not just collecting indicators.