Explain like I'm five · Security
What are TTPs?
Tactics, Techniques and Procedures, told as a story about a burglar's habits.
A burglar moves the same way every time.Window → kitchen → safe. That's a habit.
A habit has three layers.The top says why, the bottom says exactly how.
Tacticwhat they want
Techniquewhich way
Procedureexactly how
Shoes change in a second. Habits don't.A footprint (IOC) goes stale in a day. A habit lasts years.
Know the habit, hang a bell on the window.A hundred disguises, and it still rings.
In one breath
TTPs = the bad guy's habits. Know them and no disguise works.
Tactics, Techniques, Procedures. They outlast any single clue, so this is where real defense is built.
When grown-ups say it
- Tactic
- The goal. Get in, hide, steal, get out — the big steps.
- Technique
- The method. Through a window, with a fake letter, with a stolen key.
- Procedure
- The exact moves. This burglar's specific routine. Differs per burglar.
- Behavior detection
- The bell on the window. Catching what they do, not what they look like.
- ATT&CK
- The habit encyclopedia. A book that names every known habit. → the encyclopedia story
Next story
The Burglar Encyclopedia →