TTP

What are TTPs?

TTPs (Tactics, Techniques and Procedures) are the description of a cyber attacker’s behaviour: which goal they pursue (tactic), which method they use to reach it (technique) and how they carry out that method in practice (procedure). The term comes from military doctrine and has become the common language of Threat Intelligence, detection and incident response in cyber security. The best-known framework that organises TTPs is MITRE ATT&CK, with MITRE ATT&CK for ICS as the variant for industrial environments.

TTPs make it possible to understand, recognise and detect attacks based on behaviour and modus operandi, rather than only on technical features such as IP addresses or malware hashes.

🧠 What do tactic, technique and procedure mean?

The three layers run from abstract to concrete. NIST describes TTPs simply as “the behavior of an actor”, with the tactic as the highest-level description and the procedure as the most detailed.

A simple example from practice:

• Tactic - Initial Access
• Technique - Exploit Public-Facing Application (T0819 in the ICS matrix)
• Procedure - exploiting a known vulnerability in a SCADA web interface exposed directly to the internet

One tactic can be achieved through many techniques. Initial Access can also come through phishing with a malicious attachment (Spearphishing Attachment, T0865) or through a compromised vendor connection (External Remote Services, T0822). If the device sits on the internet without any protection, no exploit is needed at all: that is Internet Accessible Device (T0883).

The lower the layer, the more specific it is and the easier an attacker can change it. A tactic such as “disable the safety function” stays the same; the exact tool or command differs from attack to attack.

🔺 Why are TTPs more valuable than IOCs?

In 2013 David Bianco published the Pyramid of Pain: a ranking of indicators by how much “pain” it causes an attacker when defenders block them. Hashes and IP addresses sit at the bottom, because an attacker can replace them in seconds. TTPs sit at the top: if you detect behaviour, the attacker has to learn a new way of working or give up.

In practice you need both: IOCs to react quickly to a known campaign, TTPs for the attacker who has already switched infrastructure.

🧩 How does MITRE ATT&CK organise TTPs?

MITRE ATT&CK is a public knowledge base of adversary behaviour, based on observed incidents. Tactics form the columns of the matrix, techniques and sub-techniques the cells, and every technique lists procedure examples: which groups and malware are known to have used it. MITRE publishes a new version twice a year; version 20 was released in October 2026.

The matrix for ICS has twelve tactics. Besides familiar IT steps such as Discovery and Lateral Movement, it contains three OT-specific tactics:

• Inhibit Response Function (TA0107) - disabling protection and safety functions, such as a SIS or alarming
• Impair Process Control (TA0106) - manipulating the physical process, for example by changing parameters
• Impact (TA0105) - the final effect: loss of view, control, production or safety

Techniques have a fixed ID, so detection rules, reports and tools refer to the same behaviour. Enterprise techniques start with T1, the original ICS techniques with T08; some newer ICS techniques, such as Command and Scripting Interpreter (T1701) from version 20, are given a T1 number. Always check IDs against the current version.

🏭 Which TTPs matter in industrial networks?

Well-known OT attacks show that attackers often abuse legitimate functions rather than exotic exploits:

Techniques that are often central to OT detection and threat hunting:

• Valid Accounts (ICS T0859, Enterprise T1078) - logging on with genuine but stolen accounts
• Remote Services (T0886) - abuse of RDP, SSH or SMB to move between systems and network segments
• Modify Alarm Settings (T0838) and Alarm Suppression (T0878) - suppressing alarms so the operator sees nothing
• Loss of View (T0829) and Loss of Control (T0827) - the operator loses sight of or control over the process via the HMI
• Manipulation of Control (T0831) - unauthorised changes to control commands

🔧 How do you use TTPs in your OT security?

A practical six-step approach:

1. Identify relevant actors - which APT groups and criminal groups target your sector? The NCSC and sector information sharing help here.
2. Select their techniques - record the matching techniques from MITRE ATT&CK for ICS, for example as a heatmap in the ATT&CK Navigator.
3. Check your visibility - can your SIEM, IDS or NDR see those techniques at all? Without logging of engineering actions and network traffic at levels 1–2, Program Download remains invisible.
4. Build detection - write behavioural rules per technique and link SOAR playbooks to them, for example for a program download outside a planned change.
5. Test with emulation - have a Red Team or Purple Team replay real TTPs in threat simulations, preferably on a test environment rather than the live process.
6. Link to controls - use MITRE D3FEND and the ATT&CK mitigations to prioritise defensive measures, and include the scenarios in your threat model and the risk assessment under IEC 62443-3-2.

For Dutch organisations this ties in with the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. Its duty of care requires appropriate measures for risk management and incident handling, and the reporting obligation assumes that you notice an incident in time. A TTP coverage overview shows the board and the supervisor concretely which threats you can see and which you cannot.

🔐 What are the pitfalls of TTP-based detection?

• Coverage is not protection - a green cell in the matrix means a rule exists, not that it works in your environment
• Too much noise - behavioural rules on legitimate administration (such as Valid Accounts) produce false positives without knowledge of normal OT behaviour
• Outdated mapping - techniques are merged, renamed or given new IDs; review your mapping with every ATT&CK release
• IT telemetry only - many OT techniques are visible only in industrial protocols, not in Windows logs
• No owner - decide who in the SOC or OT SOC maintains the TTP library, so that proactive security does not fade away

❓ Frequently asked questions

What is the difference between a tactic and a technique?

A tactic is an attacker’s intermediate goal, such as gaining access or disabling a safety function. A technique is the method used to reach that goal, such as logging on with a stolen account. One tactic can therefore be achieved through many different techniques.

Are TTPs the same as MITRE ATT&CK?

No, TTPs are a general concept for adversary behaviour, whereas MITRE ATT&CK is a specific framework that organises and numbers that behaviour. ATT&CK is the de facto standard, however, so in practice TTPs are often referred to by their ATT&CK IDs.

Why are TTPs harder to evade than IOCs?

An attacker can change an IP address or hash in a few minutes, but changing a way of working takes time and expertise. Detection based on TTPs therefore forces the attacker to develop new techniques. That is the core of David Bianco’s Pyramid of Pain.

Is there a separate TTP list for OT?

Yes, MITRE ATT&CK for ICS describes TTPs specifically for industrial control systems, with twelve tactics including Inhibit Response Function and Impair Process Control. The ICS matrix was published in early 2020 and has been updated with every ATT&CK release since.

How do you share TTPs with other organisations?

TTPs are usually shared in threat intelligence reports using ATT&CK IDs, or in machine-readable form in STIX 2.1, where a technique is recorded as an Attack Pattern object. Sector ISACs and the NCSC distribute such information among their participants.

Can a small organisation use TTPs?

Yes, by starting with a handful of techniques that occur most often in its own sector, such as Valid Accounts and Remote Services. A small organisation does not need to cover the whole matrix; targeted logging of remote access and program changes already delivers a lot.

📌 In summary

TTPs describe attacker behaviour at three levels, which makes them more durable and harder to evade than technical indicators such as IP addresses and hashes. For OT environments, TTPs from MITRE ATT&CK for ICS form the bridge between threat intelligence, detection, exercises and risk assessment.