TTP

The behavior patterns that characterize a threat actor.

TTPs describe the tactics, techniques, and procedures that characterize how a threat actor operates, from high level goals down to specific tool use. Frameworks such as MITRE ATT&CK catalog these behaviors to support detection and threat hunting. Because TTPs reflect actor habits, they are harder to change than indicators like file hashes or IP addresses, making them more durable for attribution and defense. They sit at the top of the pyramid of pain for adversaries to alter.