Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat are Tactics, techniques, and procedures (TTPs)?
Tactics, techniques, and procedures (TTPs) are the observed patterns that describe how threat actors plan, execute, and repeat cyberattacks.
In cybersecurity, Tactics techniques and procedures (TTPs) help defenders move beyond isolated indicators such as IP addresses or file hashes. They explain attacker intent, the methods used to achieve that intent, and the specific steps attackers follow in real environments.
How does it work?
TTP analysis organizes adversary behavior into three levels. Tactics describe the attacker’s objective, techniques describe the method used to achieve it, and procedures describe the exact implementation seen during an incident or campaign.
Security teams use Tactics techniques and procedures (TTPs) during threat intelligence, detection engineering, incident response, and security validation. By mapping attacker behavior, teams can build stronger controls, detect recurring methods, and prioritize remediation based on how adversaries actually operate.
| TTP layer | What it shows |
| Tactic | The attacker’s goal, such as gaining access, escalating privileges, moving laterally, or exfiltrating data. |
| Technique | The general method used, such as phishing, credential dumping, command execution, or abuse of remote services. |
| Procedure | The specific way a technique is carried out, including tools, scripts, timing, infrastructure, or commands observed. |
TTPs vs indicators of compromise
Indicators of compromise are specific artifacts that suggest malicious activity, such as domains, hashes, IP addresses, registry keys, or filenames. They are useful for quick detection, but attackers can change them easily.
TTPs are harder for attackers to replace because they reflect behavior and operational habits. For example, a malicious IP may disappear overnight, but repeated use of credential dumping followed by lateral movement gives defenders a stronger pattern to detect and investigate.
How Hexnode supports TTP analysis
Hexnode supports TTP analysis by giving IT and security teams endpoint visibility, policy enforcement, compliance checks, patch workflows, application controls, and remote actions across managed devices.
When threat intelligence points to endpoint-focused behavior, Hexnode UEM can help teams validate device posture, restrict risky configurations, deploy updates, control applications, and take remote remediation actions. This helps connect adversary behavior to practical endpoint defense.
When should organizations use it?
Organizations should use TTP analysis when they need stronger detection logic, better incident context, and more resilient defenses than indicator-based blocking alone. It is especially useful for SOC teams, threat hunters, incident responders, and organizations aligning defenses to frameworks such as MITRE ATT&CK.
Tactics techniques and procedures (TTPs) are also valuable after an incident. They help teams understand what happened, identify control gaps, improve playbooks, and prevent similar attacker behavior from succeeding again.
FAQs
No. TTPs can describe nation-state activity, ransomware campaigns, commodity malware, insider misuse, phishing operations, or any repeatable attacker behavior.
Teams often document TTPs in incident reports, threat intelligence briefs, detection rules, hunting queries, and mappings to frameworks such as MITRE ATT&CK.
Yes. Behavior-based detection can reduce noise by focusing on meaningful sequences of activity instead of treating every single artifact as equally important.
