In the context of CompTIA CySA+ and Security Operations, Tactics, Techniques, and Procedures (TTPs) describe the specific behaviors, methods, and patterns of activity used by threat actors. TTPs are crucial for Cyber Threat Intelligence (CTI) and Attribution because they allow analysts to identify …In the context of CompTIA CySA+ and Security Operations, Tactics, Techniques, and Procedures (TTPs) describe the specific behaviors, methods, and patterns of activity used by threat actors. TTPs are crucial for Cyber Threat Intelligence (CTI) and Attribution because they allow analysts to identify adversaries based on behavior rather than easily changeable static indicators.
**Tactics** represent the strategic 'why' or the high-level goals of an attack. They describe the objective the attacker is trying to achieve, such as Initial Access, Privilege Escalation, Lateral Movement, or Exfiltration. The MITRE ATT&CK framework allows analysts to map these goals systematically.
**Techniques** represent the generalized 'how.' They describe the specific methods used to achieve a tactical goal. For example, if the tactic is 'Persistence' (maintaining access), the technique might be 'Scheduled Task/Job' or 'Registry Run Keys.' Techniques explain the mechanism of the attack without getting into specific tool configurations.
**Procedures** describe the granular 'exact how.' They detail the specific implementation, tools, sequences of commands, or malware variants used. A procedure might be the specific PowerShell command string `New-ScheduledTask -Action...` used to implement the persistence technique.
For a security analyst, TTPs reside at the top of the 'Pyramid of Pain.' While attackers can easily change low-level Indicators of Compromise (IoCs) like file hashes, IP addresses, or domain names, changing their TTPs requires them to learn new behaviors and redesign their toolkit. Therefore, detection rules built around TTPs (behavioral analysis) are far more resilient and effective than traditional signature-based detection, allowing analysts to hunt for threats proactively even when specific tools change.
Tactics, Techniques, and Procedures (TTPs) in Threat Intelligence
Understanding TTPs in the Context of CompTIA CySA+
In the realm of Security Operations and Threat Intelligence, analyzing the behavior of adversaries is crucial for moving beyond simple reactive defenses. This analysis is encapsulated in the concept of Tactics, Techniques, and Procedures (TTPs). While Indicators of Compromise (IoCs) like IP addresses and file hashes change rapidly, TTPs represent the fundamental behavior of a threat actor, which is much harder for them to change without relearning their trade.
What are TTPs? TTPs break down a cyberattack into three hierarchical layers:
1. Tactics (The 'Why'): This describes the adversary's tactical goal or the reason for performing an action. It is the highest level of the hierarchy. Examples include Initial Access, Privilege Escalation, or Exfiltration. 2. Techniques (The 'How'): This describes the specific method used to achieve the tactical goal. For the tactic of 'Initial Access,' a technique might be Phishing or Exploiting Public-Facing Applications. 3. Procedures (The 'Specific Steps'): This is the most granular level, detailing the exact tools or steps the adversary used to execute the technique. For example, sending a phishing email containing a malicious Excel macro that executes a specific PowerShell script.
Why is it Important? The concept of TTPs is central to the Pyramid of Pain. Detecting and blocking TTPs inflicts the most 'pain' on the adversary because it forces them to change their entire methodology, which requires significant time and resources. Unlike blocking an IP address (which an attacker can change in seconds), detecting a TTP (like the behavior of passing-the-hash) renders a whole class of attacks ineffective regardless of the specific tools used.
How it Works in Security Operations Security analysts use frameworks like MITRE ATT&CK to standardize TTP identification. When an incident occurs, the analyst does not just clean up the malware; they analyze the attack behavior to map it to known threat groups (Attribution).
The process generally involves: 1. Observation: Collecting logs and forensic data. 2. Abstraction: Converting raw data into behavioral patterns (e.g., noticing that `svchost.exe` launched `powershell.exe`). 3. Mapping: Correlating these patterns to the MITRE ATT&CK matrix. 4. Action: Creating detection rules (like SIGMA rules) that trigger when that specific behavior is observed, regardless of the file names involved.
Exam Tips: Answering Questions on Tactics, techniques, and procedures (TTPs)
For the CompTIA CySA+ exam, you will likely face scenario-based questions requiring you to distinguish between IoCs and TTPs, or to identify which part of the TTP triad is being described.
1. Distinguish TTPs from Static IoCs: If a question asks for the "most effective way to identify a threat actor's behavior," look for TTPs. If it asks for quick blocking of a specific file, look for Hashes or IP addresses. Remember: IoCs identify tools; TTPs identify the actor.
2. The MITRE Association: Connect TTPs immediately with the MITRE ATT&CK framework. If a question mentions mapping adversary behaviors to a standard knowledge base, the answer is usually MITRE ATT&CK or TTP analysis.
3. Hierarchy Identification: You may be given a scenario and asked to identify the Tactic or Technique. Scenario: "The attacker is trying to steal user credentials to move laterally." Analysis: Stealing credentials is the Goal/Tactic (Credential Access). Dumping LSASS memory is the Technique.
4. Threat Intelligence Lifecycle: Understand that TTPs are the output of the Analysis phase of the Threat Intelligence Lifecycle and are used to inform the Dissemination phase to help other organizations defend against similar distinct behaviors.