📖 What is Tactics, Techniques, and Procedures (TTPs)?
Tactics, Techniques, and Procedures (TTPs) describe the behavior of a threat actor. Tactics are the high-level goals, techniques are the specific methods used to achieve those goals, and procedures are the detailed step-by-step sequences of actions taken during an attack.
"When you see 'behavioral analysis' on the exam, think TTPs. It is about how they attack, not just what specific tool they use."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Tactics, Techniques, and Procedures (TTPs)?
- ▸ Tactics represent the high-level strategic goals of an attacker, such as gaining initial access, escalating privileges, or exfiltrating sensitive data from a network.
- ▸ Techniques are the specific methods used to achieve a tactic, such as using spear-phishing for initial access or DLL side-loading for persistence.
- ▸ Procedures are the granular, step-by-step sequences of actions, including specific commands and tools, that an adversary executes to implement a chosen technique.
- ▸ TTPs are foundational to the MITRE ATT&CK framework, which provides a standardized taxonomy for mapping adversary behaviors to known threat actor groups.
- ▸ Behavioral analysis focusing on TTPs is more resilient than signature-based detection because attackers can change their tools faster than they can change their habits.
🎯 How does Tactics, Techniques, and Procedures (TTPs) appear on the CS0-003 Exam?
You may be asked to analyze a set of incident logs and determine whether the observed activity represents a specific tactic, technique, or a detailed procedure.
A scenario might describe a threat actor changing their malware hashes and IP addresses, requiring you to identify TTPs to maintain visibility through behavioral analysis.
Expect questions where you must use a threat intelligence report to map observed adversary behaviors to the MITRE ATT&CK framework for attribution purposes.
❓ Frequently Asked Questions
Why are TTPs considered more durable than Indicators of Compromise (IoCs)?
IoCs like IP addresses and file hashes are 'brittle' because attackers can change them instantly. TTPs describe behavioral patterns and habits, which are much harder for an adversary to alter without significant retraining or restructuring.
How do I distinguish between a technique and a procedure on the exam?
Think of the technique as the 'method' (e.g., Process Injection) and the procedure as the 'recipe' (e.g., using a specific PowerShell script to inject code into explorer.exe). Procedures are the most detailed level of the TTP hierarchy.