TTP: Tactics, Techniques, and Procedures in Cybersecurity
TTP stands for Tactics, Techniques, and Procedures. TTPs describe the behavior patterns of threat actors, from high-level goals (tactics) to specific methods (techniques) and detailed implementation steps (procedures). The MITRE ATT&CK framework organizes known adversary TTPs into a structured knowledge base.
How TTP Is Used in Cybersecurity
Threat intelligence analysts map adversary TTPs to MITRE ATT&CK to profile threat groups and predict their next moves. SOC teams build detection rules that target specific techniques rather than relying solely on IOC signatures. Incident responders use TTP analysis to attribute attacks and understand the full scope of an intrusion.
Read the full glossary entry: Tactics, Techniques, and Procedures in Cybersecurity
Cybersecurity Roles That Work with TTP
Related Cybersecurity Acronyms
Frequently asked questions
What does TTP stand for?
TTP stands for Tactics, Techniques, and Procedures. TTPs describe the behavior patterns of threat actors, from high-level goals (tactics) to specific methods (techniques) and detailed implementation steps (procedures). The MITRE ATT&CK framework organizes known adversary TTPs into a structured knowledge base.
What is TTP used for in cybersecurity?
Threat intelligence analysts map adversary TTPs to MITRE ATT&CK to profile threat groups and predict their next moves. SOC teams build detection rules that target specific techniques rather than relying solely on IOC signatures. Incident responders use TTP analysis to attribute attacks and understand the full scope of an intrusion.
Definitions are original explanations written for career development purposes. For authoritative technical definitions, refer to NIST, ISO, or the relevant standards body.