📖 What is TTPs (Tactics, Techniques, and Procedures)?
TTPs (Tactics, Techniques, and Procedures) refer to the behavioral patterns and methodologies used by threat actors to execute attacks. Understanding TTPs allows security analysts to move beyond simple indicators of compromise and identify the overarching strategy and habits of a specific adversary or threat group.
"Relate this to the MITRE ATT&CK framework; that is the primary way TTPs are categorized for the exam."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of TTPs (Tactics, Techniques, and Procedures)?
- ▸ Tactics represent the high-level strategic goals of an attacker, such as gaining initial access or maintaining persistence within a compromised network.
- ▸ Techniques describe the specific methods used to achieve a tactic, such as using spear-phishing with a malicious attachment for entry.
- ▸ Procedures are the detailed, step-by-step implementations of techniques, often involving specific tools, scripts, or command-line sequences unique to a threat actor.
- ▸ The MITRE ATT&CK framework provides a globally accessible knowledge base that categorizes TTPs, allowing pentesters to emulate real-world adversary behaviors.
- ▸ In the Pyramid of Pain, TTPs are the most difficult for attackers to change, making them the most valuable indicators for detection.
🎯 How does TTPs (Tactics, Techniques, and Procedures) appear on the PT0-002 Exam?
You may be asked to map a set of observed attacker behaviors—such as using PowerShell for discovery and creating a scheduled task—to the appropriate categories within the MITRE ATT&CK framework.
A scenario might describe a red team engagement where you are tasked with emulating a specific advanced persistent threat (APT) group by replicating their known TTPs to test defenses.
Expect questions asking you to differentiate between a tactic and a technique when analyzing a breach report to determine the attacker's ultimate objective versus their specific method of execution.
❓ Frequently Asked Questions
How do TTPs differ from Indicators of Compromise (IoCs)?
IoCs are static artifacts like IP addresses or file hashes that are easy for attackers to change. TTPs describe behavioral patterns, which are much harder for adversaries to alter without changing their entire operational approach.
Why is the MITRE ATT&CK framework critical for a PenTest+ professional?
It provides a standardized language and map for adversary behavior. Pentesters use it to ensure their testing coverage is comprehensive and aligns with the actual methods used by modern threat actors.