🔍 What Is It?

TTPs breaks down how anyone carries out a plan into three layers — the big goal, the method they pick, and the exact steps they follow.

TTP stands for Tactics, Techniques, and Procedures. It is a way of describing exactly how someone — usually a hacker, but also a soldier or a criminal — carries out an attack. Instead of just saying a hacker broke in, TTPs let experts write down every layer of the plan: what the attacker was ultimately trying to achieve, which method they chose to get there, and the precise step-by-step moves they made.

Security teams — people whose job is to protect computer networks — use TTPs the way a sports coach uses film of the opposing team. If you know your enemy’s TTPs, you can spot their moves early and build a specific defense for each one. Sharing TTPs also lets defenders around the world learn from each other, so when one team discovers a brand-new attack method, everyone else can prepare immediately.

Militaries and police have used this idea for decades, but today it matters most in cybersecurity. A giant public database called MITRE ATT&CK — think of it as an encyclopedia of every known hacker move, organized by TTPs — is used by security teams at companies and governments worldwide. Once you understand TTPs, you understand how the whole field of cybersecurity defense is organized.

🧸 Think Of It Like This

The Soccer Spy Notebook

Imagine your soccer coach wants to beat the toughest team in the league. She watches hours of their game footage and writes everything down in a notebook. At the top she writes the Tactic: they always try to score by rushing down the left side. Underneath that she writes the Technique: they use fast short passes to slip past defenders. Then at the very bottom she lists every tiny Procedure: player 7 receives the ball at midfield, passes immediately to player 11 who sprints to the corner flag, then crosses low to player 9 waiting at the near post. Now your whole team knows the rival’s playbook at every level — the big goal, the method, and the exact footsteps — so you can build a specific counter-move for each one.

🖼️ Picture It

TTPs: Three Levels of the PlanTACTICSBig Goal: attack down the left sideTECHNIQUESMethod: quick passes to slip past defendersPROCEDURESExact Steps: #7 passes to #11 who sprints to corner,then crosses low to #9 at the near postGeneral (the big picture)Specific (tiny steps)

🔀 How It Breaks Down

flowchart TD
    A[TACTICS: What is the big goal?] --> B[TECHNIQUES: What method achieves it?]
    B --> C[PROCEDURES: What are the exact steps?]

🌍 Real World Example

In 2021, a criminal hacker group called DarkSide attacked the Colonial Pipeline — a huge fuel pipeline in the southeastern United States — and forced it to shut down by locking its computer systems and demanding money. Cybersecurity investigators used TTPs to map exactly how it happened: the tactic was to extort money, the technique was sneaking in through a stolen employee password, and the procedures detailed every specific command the hackers ran once they were inside. The FBI and a US government cybersecurity agency called CISA then published those TTPs publicly so that companies across America could check whether attackers could use the exact same moves against them and fix the weaknesses before the next attack.

Colonial Pipeline Attack (2021) Mapped as TTPsTACTICExtort money by locking pipeline computersTECHNIQUEBreak in using a stolen employee passwordPROCEDURES1. Buy the stolen password from an underground online market2. Log into company remote-access system using that password3. Spread file-locking software silently across the network4. Encrypt all files and display ransom note demanding BitcoinFBI and CISA published these exact TTPs so other companies could find and close the same gaps

🎯 Try It Yourself

  • AI companies like OpenAI and Google are seeing attacks where criminals try to trick AI assistants into ignoring their safety rules — a method called prompt injection, where hidden instructions are disguised as normal text. Mapping these attacks as TTPs helps AI safety teams catalog every known method and build filters that recognize the early steps of an attack before the AI does something harmful.
  • Hospital networks across the US keep getting hit by criminal groups using ransomware — software that locks all your files until you pay money. Health regulators now push hospitals to share TTP reports with each other: if one hospital discovers attackers got in by exploiting a specific remote-login tool, every other hospital can immediately check whether that same tool is unprotected in their own network and patch it.
  • Social media companies like Meta and X fight coordinated fake-account campaigns that try to spread false stories before elections. Writing those campaigns down as TTPs — tactic: create public confusion; technique: flood trending topics; procedure: post hundreds of identical phrases within one hour — lets platform engineers build automated systems that detect the pattern and remove the accounts before the false story spreads widely.
  • Car manufacturers like Toyota and GM depend on hundreds of small suppliers for computer chips and software. Hackers target the weakest supplier to sneak malicious code into car software before it ships to customers. Sharing TTPs across the whole auto industry means every supplier knows which exact login systems and software tools hackers are targeting right now, so they can fix those weaknesses before the attack reaches a major carmaker.