ไทย
English
Tactics, Techniques, and Procedures, commonly known as TTPs in Cybersecurity, are used to describe how a threat actor behaves during an attack. TTPs help security teams understand not only what happened, but also why the attacker did it, how they did it, and what exact steps they used.
TTPs help security teams understand more than just what happened. They help explain:
- What the attacker is trying to achieve
- How the attacker attempts to achieve it
- What specific actions or steps the attacker performs
According to the NIST Computer Security Resource Center, TTPs refer to the behavior of an actor. A tactic is the highest-level description of that behavior, techniques provide a more detailed description within the context of a tactic, and procedures provide a lower-level, highly detailed description within the context of a technique.
In simple terms:
| TTP Element | Meaning |
| Tactic | The attacker’s objective |
| Technique | The method used to achieve that objective |
| Procedure | The specific steps, tools, commands, or actions used in practice |
Table of Contents
What is a Tactic?
A tactic describes the attacker’s high-level objective.
MITRE ATT&CK defines tactics as the “why” of an ATT&CK technique or sub-technique. It is the adversary’s tactical goal, or the reason for performing an action. For example, an adversary may want to achieve credential access.
In other words:
Tactic = Why the attacker is performing the action
Examples of MITRE ATT&CK Enterprise Tactics include:
| ID | Tactic | MITRE ATT&CK Description |
| TA0043 | Reconnaissance | The adversary is trying to gather information they can use to plan future operations. |
| TA0042 | Resource Development | The adversary is trying to establish resources they can use to support operations. |
| TA0001 | Initial Access | The adversary is trying to get into your network. |
| TA0002 | Execution | The adversary is trying to run malicious code. |
| TA0003 | Persistence | The adversary is trying to maintain their foothold. |
| TA0004 | Privilege Escalation | The adversary is trying to gain higher-level permissions. |
| TA0005 | Stealth | The adversary is trying to hide and conceal their actions, appearing as normal behavior. |
| TA0112 | Defense Impairment | The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening. |
| TA0006 | Credential Access | The adversary is trying to steal account names and passwords. |
| TA0007 | Discovery | The adversary is trying to figure out your environment. |
| TA0008 | Lateral Movement | The adversary is trying to move through your environment. |
| TA0009 | Collection | The adversary is trying to gather data of interest to their goal. |
| TA0011 | Command and Control | The adversary is trying to communicate with compromised systems to control them. |
| TA0010 | Exfiltration | The adversary is trying to steal data. |
| TA0040 | Impact | The adversary is trying to manipulate, interrupt, or destroy your systems and data. |
MITRE ATT&CK Enterprise currently lists 15 Enterprise Tactics.
What is a Technique?
A technique describes how an attacker achieves a tactical goal.
MITRE ATT&CK defines techniques as the “how” an adversary achieves a tactical goal by performing an action. For example, an adversary may dump credentials to achieve credential access.
In other words:
Technique = How the attacker performs the action
Examples of MITRE ATT&CK Enterprise Techniques include:
| ID | Technique | MITRE ATT&CK Description |
| T1548 | Abuse Elevation Control Mechanism | Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. |
| T1134 | Access Token Manipulation | Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. |
| T1087 | Account Discovery | Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. |
| T1098 | Account Manipulation | Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. |
| T1650 | Acquire Access | Adversaries may purchase or otherwise acquire an existing access to a target system or network. |
| T1583 | Acquire Infrastructure | Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. |
| T1595 | Active Scanning | Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. |
MITRE ATT&CK Enterprise currently lists 222 Techniques and 475 Sub-techniques.
In addition to Enterprise Tactics and Techniques, MITRE ATT&CK also includes Tactics and Techniques for other contexts, such as Mobile for attack behaviors on mobile devices and ICS for industrial control systems or Operational Technology environments. Each matrix contains Tactics, Techniques, and Sub-techniques that are designed to suit its specific environment.
What is a Procedure?
The procedure is the most detailed part of TTPs. It explains the specific way a technique is carried out in a real-world scenario.
A procedure may include:
- The tools used by the attacker
- The commands executed
- The infrastructure used
- The sequence of actions performed
- The specific configuration or method used in the attack
In simple terms:
Procedure = The exact way the attacker performs the technique
For example:
| Tactic | Technique | Example Procedure |
| Initial Access | Phishing | The attacker sends a fake Microsoft 365 login email to employees and directs them to a credential-harvesting page. |
| Credential Access | Credential dumping | The attacker uses a credential dumping tool to extract passwords or hashes from system memory. |
| Discovery | Account Discovery | The attacker attempts to list valid usernames, email addresses, or domain accounts in the environment. |
| Persistence | Account Manipulation | The attacker modifies an account, changes credentials, or adds permissions to maintain access. |
| Resource Development | Acquire Infrastructure | The attacker buys, leases, or obtains infrastructure such as domains, servers, VPS instances, or web services to support operations. |
Example: Understanding TTPs in a Realistic Attack Scenario
Imagine an attacker wants to compromise an organization’s cloud email environment.
The attack may look like this:
- The attacker prepares a fake Microsoft 365 login page.
- The attacker sends phishing emails to employees.
- An employee enters their username and password into the fake login page.
- The attacker uses the stolen credentials to access the real email account.
- The attacker searches the mailbox for sensitive data or other useful accounts.
- The attacker may create forwarding rules or modify account settings to maintain access.
This activity can be described using TTPs:
| Level | Example |
| Tactic | Initial Access / Credential Access / Discovery / Persistence |
| Technique | Phishing / Account Discovery / Account Manipulation |
| Procedure | The attacker sends a fake Microsoft 365 login email, captures the employee’s credentials, logs into the cloud email account, searches for useful information, and modifies account settings to maintain access. |
This shows that one cyber-attack may involve multiple tactics and techniques. Real-world attacks often happen in stages, from initial access to credential theft, discovery, persistence, lateral movement, exfiltration, or impact.
Why are TTPs Important?
TTPs are important because they help security teams focus on attacker behavior rather than only technical indicators.
Many security investigations rely on Indicators of Compromise, or IOCs, such as:
- IP addresses
- Domains
- URLs
- File hashes
- Email addresses
- Malware filenames
These indicators are useful, but they can change quickly. An attacker can switch to a new IP address, register a new domain, modify malware, or change a phishing URL.
TTPs are more behavior-focused. They describe the attacker’s methods and patterns, which are often harder to change.
For example, an attacker may change the phishing domain, but still use the same overall phishing technique, email theme, credential-harvesting process, or account manipulation behavior.
By understanding TTPs, security teams can:
| Benefit | Explanation |
| Improve detection | Build detection logic based on attacker behavior, not only known IOCs. |
| Support incident response | Understand how the attack happened and what should be investigated next. |
| Identify attack patterns | Connect multiple incidents that share similar behavior. |
| Improve threat hunting | Search proactively for signs of adversary behavior across systems. |
| Strengthen defenses | Prioritize controls against common attacker methods. |
| Enhance threat intelligence | Map observed behavior to known adversary groups, tools, or campaigns. |
TTPs and MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary behavior based on real-world observations. It organizes attacker behavior into structured categories that security teams can use for detection, investigation, threat hunting, and reporting.
In MITRE ATT&CK:
| ATT&CK Component | Purpose |
| Tactics | Describe the adversary’s tactical goals. |
| Techniques | Describe how the adversary achieves those goals. |
| Sub-techniques | Provide more specific variations of techniques. |
| Procedures | Describe specific ways techniques are used by adversaries, tools, or campaigns. |
For example, if a CSOC team observes that an attacker is trying to list valid accounts in an environment, that behavior may be mapped to the MITRE ATT&CK technique Account Discovery. MITRE describes this technique as adversaries attempting to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
Mapping security events to MITRE ATT&CK helps teams understand where the attacker may be in the attack lifecycle and what they may attempt next.
TTPs vs IOCs
TTPs and IOCs are both useful in cybersecurity, but they serve different purposes.
| Topic | IOC | TTP |
| Meaning | A specific indicator that may suggest compromise | The attacker’s behavior, method, or pattern |
| Examples | IP address, domain, URL, file hash | Phishing, Account Discovery, Credential Dumping, Account Manipulation |
| Stability | Can change quickly | Often harder for attackers to change |
| Main Use | Detect known malicious artifacts | Understand and detect attacker behavior |
| Question Answered | What did we observe? | What did the attacker do, and how? |
A simple way to remember the difference:
IOCs show what was observed. TTPs explain how the attacker behaved.
For example, a malicious IP address used in an attack is an IOC. However, phishing a user, stealing credentials, logging into a cloud account, and modifying account permissions are examples of TTPs.
Summary
Tactics, Techniques, and Procedures help cybersecurity teams describe attacker behavior in a structured way.
| Element | Simple Meaning |
| Tactic | The attacker’s goal |
| Technique | The method used to achieve the goal |
| Procedure | The specific steps or actions performed |
In short:
Tactic = Why the attacker is acting
Technique = How the attacker acts
Procedure = What the attacker specifically does
Using TTPs together with MITRE ATT&CK allows security teams to analyze incidents more clearly, improve detection engineering, support threat hunting, and communicate cyber threats in a standardized way.
Instead of focusing only on changing indicators such as IP addresses or file hashes, TTP-based analysis helps organizations understand the attacker’s behavior and prepare stronger defenses.
Understanding attacker TTPs is the first step toward stronger cyber defense.
BMSP helps organizations detect, analyze, and respond to cyber threats with professional cybersecurity services tailored to your business needs.
Contact BMSP today to strengthen your security posture and stay ahead of evolving threats.
References
- National Institute of Standards and Technology. “Tactics, Techniques, and Procedures (TTP).” NIST Computer Security Resource Center Glossary.
https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures - MITRE ATT&CK. “Enterprise Tactics.”
https://attack.mitre.org/tactics/enterprise/ - MITRE ATT&CK. “Enterprise Techniques.”
https://attack.mitre.org/techniques/enterprise/
