TTP (Tactics, Techniques, and Procedures)

Tactics describe the high-level goals of an attacker, techniques describe how those goals are achieved, and procedures are the specific implementations used in a given attack. Understanding TTPs, as catalogued in frameworks like MITRE ATT&CK, allows SOC teams to detect sophisticated threats that don't match known signatures and to reason about attacker intent and next likely steps.