Tactics, Techniques and Procedures (TTPs) - definition & overview

Tactics techniques and procedures (TTPs) are fundamental components used in the field of cybersecurity, threat intelligence and incident response, and they describe how cyber adversaries operate and execute attacks. These three elements provide a structured way to understand the methods and behaviors of a threat group and a specific threat actor.

TTPs are key components of MITRE ATT&CK, a knowledge base, framework and methodology for cybersecurity professionals to understand, categorize and respond to cyber threats and attacks.

Tactics answer the "what" question by defining the high-level objectives of an attack, techniques answer the "how" question by describing the methods adversaries use to achieve those objectives, and procedures answer the "how exactly" question by providing concrete examples and implementation details of techniques. This hierarchical structure within the MITRE ATT&CK framework helps security professionals understand and respond to cyber threats effectively.

The TTPs in the MITRE ATT&CK framework are used in various ways to enhance cybersecurity practices and defense against emerging threats and a potential threat, including an advanced persistent threat.

Tactics
Security professionals and threat hunters can use tactics to understand the overarching goals of adversaries, helping them anticipate potential attack vectors. Organizations can assess their security posture by considering the relevance of tactics. By understanding which tactics are most likely to be targeted, they can prioritize security measures accordingly.

Techniques
Security teams can map known adversary techniques to their environment's logs and data sources to create custom detection rules and alerts. During and after a security incident, security professionals can also refer to techniques to understand how adversaries have executed their attacks at various stages of the cyber kill chain. This information helps in scoping the incident, identifying compromised systems and planning an effective response.

Procedures
Security analysts can use procedures to gain insights into the practical application of techniques. Procedures can also sometimes provide clues about the identity or origin of a malicious actor based on unique characteristics or artifacts left behind during an attack.

Here’s how tactics, techniques and procedures relate to one another in some common examples:

Tactic: Initial access
Technique: Spearphishing email
Procedures: The specific email templates used by attackers, the file types they commonly attach and the social engineering tactics used.

Tactic: Credential access
Technique: Credential dumping
Procedures: The specific tools, commands and techniques used to extract passwords and hashes.

Tactic: Data exfiltration
Technique: Command and control channels
Procedure: The data exfiltration method, encryption used and the destination for stolen data.

TTP analysis is a valuable approach for defending against cyber attackers. It involves studying and understanding the behavior and methods used by cybercriminals and threat actors. TTP analysis is also critical to proactive threat detection, response and defense against cybercrime. By understanding how cybercriminals operate, organizations can better prepare for and mitigate the risks associated with today's evolving threat landscape.

Identifying TTPs used by cyber adversaries offers several benefits for organizations and their cybersecurity efforts:

• Enhanced threat detection
  By identifying threat actors' specific methods and behaviors, a security team can create custom detection rules and finely tuned signatures to spot malicious activities.

• Proactive defense
  By focusing on the tactics and techniques used by adversaries, organizations can implement security controls and measures that directly address these attack methods.

• Customize threat intelligence
  Organizations can create custom threat intelligence that aligns with the TTPs relevant to their specific environment.

• Incident response preparedness
  When a security incident occurs, a security team can quickly recognize the tactics and techniques used and respond more effectively, potentially minimizing the impact of an attack.

• Adversary attribution
  Analyzing TTPs can contribute to attributing threat actors, helping organizations understand who they are dealing with.

• Security awareness and training
  Security awareness programs can use examples of TTPs to help employees recognize and respond to adversary behavior.

• Prioritization of security measures
  By understanding which tactics and techniques are most likely to be used in their industry or environment, organizations can allocate resources to the most critical security measures.

• Collaboration
  By sharing information about observed TTPs with peers, organizations may engage in joint tactics by sharing threat intelligence, indicators of compromise (IOCs) and attack patterns with one another.

Analyzing the right data with your security tools is the first step to building a healthy security posture. By aligning log management with MITRE ATT&CK TTPs, organizations can fine-tune their security rules for optimal performance. This ensures that security alerts are both accurate and relevant. For enhanced cybersecurity, security analysts need to be able to harness TTPs effectively.

Using Sumo Logic’s security information and event management (SIEM) solution, your security operations center can integrate the MITRE ATT&CK framework for precise cyber threat intelligence and response by categorizing attacks based on their TTPs. Identifying the TTPs that are most important enables Sumo Logic customers to ensure they are ingesting the correct log data. Read our ultimate guide to modern SIEM and learn more about Sumo Logic Cloud SIEM.