Cybersecurity definition
What is TTP?
TTP stands for Tactics, Techniques, and Procedures.
By Cyber Tool Stack Editorial TeamUpdated
Definition
The way security teams describe attacker behavior at three levels of detail — the high-level goal (tactic), the general method (technique), and the specific implementation (procedure) — most commonly organized using the MITRE ATT&CK framework.
Where TTP fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
MITRE ATT&CKAdversarial Tactics, Techniques, and Common KnowledgeA free, continuously updated knowledge base, maintained by the MITRE Corporation, that catalogs real-world attacker behavior as a matrix of tactics (the attacker's goal, like lateral movement) and techniques (how it's done), giving defenders a shared vocabulary for describing and detecting threats.IOCIndicator of CompromiseForensic evidence that a system has already been breached — a malicious file hash, a known-bad IP address, a suspicious registry key — used to detect or confirm past or ongoing compromise.IOAIndicator of AttackA signal that describes an attacker's intent and behavior in progress — such as a process trying to dump credentials — rather than a static artifact left behind, letting defenses catch an attack while it's still unfolding instead of only after the fact.