TTP

Tactics, techniques and procedures: how an attacker behaves. The tactic is the goal (such as initial access), the technique is how it is achieved, and the procedure is the specific way a given group carries it out. Attackers swap IP addresses and domains easily but change their TTPs slowly, so detections built on TTPs outlast IOC blocklists.

Further reading: csrc.nist.gov

All terms