Tactics vs Techniques vs Procedures: The Difference in Cybersecurity
Tactics define the attacker’s goal, techniques describe the method, and procedures are the specific steps, creating a hierarchy that dictates detection strategy.
Tactics are the high-level objectives an adversary pursues to compromise a system. Techniques are the general methods used to achieve those objectives. Procedures are the specific actions, tools, or code sequences executed to implement the technique. Understanding this hierarchy allows you to detect patterns rather than just known bad files.
What is the difference between tactics techniques and procedures?
Tactics, techniques, and procedures form a hierarchical framework that describes adversary behavior from abstract intent to concrete execution. Tactics represent the tactical objective, such as gaining initial access or maintaining persistence. Techniques are the general methods used to achieve these tactical objectives, such as phishing or exploiting a vulnerability. Procedures are the specific, repeatable steps or tool configurations an attacker uses to execute a technique. This structure allows defenders to map attacks logically rather than reacting to isolated events.
The distinction matters because detection strategies differ at each level. If you only monitor for specific procedures, such as a particular hash of a malware file, you miss variations. If you monitor for tactics, such as data exfiltration, you create overly broad alerts. The optimal approach sits at the technique level, where behaviors are specific enough to be actionable but broad enough to catch novel implementations.
Why does the hierarchy matter for detection?
The hierarchy matters because it determines the scope and precision of your security controls. A tactic is too broad to trigger an alert directly, as legitimate administrative tasks often resemble malicious intent. A procedure is too narrow, as attackers change tools and scripts frequently. Techniques offer the best balance by describing observable behaviors that remain consistent even when the underlying tools change. This balance reduces false positives while maintaining coverage against evolving threats.
Imagine a defender who only blocks known malicious IP addresses. This is a procedure-level control. When the attacker changes their command and control traffic infrastructure, the control fails. A technique-level control, such as detecting unusual outbound DNS queries, catches the behavior regardless of the specific IP address. This shift from signature-based to behavior-based detection is central to modern defense strategies.
How do tactics define attacker intent?
Tactics define the "why" behind an attack, mapping to specific stages of the kill chain. Common tactics include reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, and command and control. Each tactic represents a strategic goal. For example, the persistence tactic aims to maintain long-term access to a compromised system despite reboots or credential changes.
Understanding tactics helps you prioritize alerts based on impact. An alert indicating the exfiltration tactic is generally higher priority than one indicating reconnaissance. Reconnaissance is often passive and may not involve direct compromise. Exfiltration indicates that data has already been collected and is leaving the network. This prioritization allows incident response teams to focus their limited resources on the most damaging activities first.
What role do techniques play in behavior analysis?
Techniques describe the "how" of an attack, providing the observable behaviors that security tools can detect. A single tactic can be achieved through multiple techniques. For instance, the initial access tactic can be achieved via spearphishing attachments, spearphishing links, or valid accounts. Each technique has distinct indicators of compromise and detection signatures. By focusing on techniques, you can build detection rules that cover multiple procedural variations.
Techniques also reveal the attacker’s sophistication. Using a common technique like password spraying suggests a low-effort, high-volume approach. Using a complex technique like process injection suggests a targeted, sophisticated actor with advanced capabilities. Recognizing this difference helps in assessing the threat level and adjusting the response accordingly. It also informs the selection of appropriate countermeasures and hardening efforts.
| Level | Question Answered | Example | Detection Focus |
|---|---|---|---|
| Tactic | Why is the attacker doing this? | Persistence | Strategic prioritization |
| Technique | How is the attacker doing this? | Registry Run Keys | Behavior-based rules |
| Procedure | What specific steps are taken? | Set value HKLM\... | Signature matching |
Why do procedures change frequently?
Procedures change frequently because they represent the specific implementation details of an attack. These details include specific file names, registry keys, API calls, or command-line arguments. Attackers modify these details to evade signature-based detection. For example, an attacker might change the name of a malicious script or obfuscate its code. The underlying technique remains the same, but the procedure changes.
This volatility makes procedure-level detection fragile. If your security information and event management system relies solely on matching specific file hashes, it will miss the next variant. You must update your signatures constantly, which is resource-intensive and often reactive. Shifting focus to technique-level detection mitigates this issue by looking for the behavior rather than the specific artifact. This approach is more resilient to minor changes in the attacker’s toolkit.
See also: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses · Red Teaming Definition: How Adversarial Simulation Works
How do you map attacks to this framework?
You map attacks to this framework by analyzing the behavior observed in logs and alerts. Start by identifying the specific procedure, such as a PowerShell command executed on a workstation. Then, determine the technique, such as script obfuscation or legitimate code execution. Finally, identify the tactic, such as defense evasion or execution. This mapping process creates a clear narrative of the attack.
Mapping attacks consistently allows you to identify gaps in your detection coverage. If you have alerts for the procedure but not the technique, you may miss variations. If you have alerts for the tactic but not the technique, you may have too many false positives. Regularly reviewing and updating your detection rules based on this mapping ensures comprehensive coverage.
What are the limitations of this model?
The model has limitations when attackers use novel techniques that are not yet documented. In these cases, there may be no known technique to map to. The attacker might use a zero-day exploit or a unique method of lateral movement. Additionally, some activities may span multiple techniques, making classification ambiguous. For example, a complex attack might involve both credential access and lateral movement simultaneously.
These limitations require a flexible approach to detection. Relying solely on known frameworks may leave blind spots. You must also employ anomaly detection and user and entity behavior analytics to identify unusual activities that do not fit known patterns. This complementary approach helps catch novel threats that fall outside the established tactics, techniques, and procedures.
How does this impact incident response?
This model impacts incident response by providing a structured way to analyze and contain breaches. When an incident occurs, responders can use the hierarchy to understand the scope and impact. Identifying the tactics used helps determine the attacker’s goals. Identifying the techniques helps identify the methods used. Identifying the procedures helps in forensic analysis and evidence collection.
Effective incident response requires understanding the relationship between tactics, techniques, and procedures. This understanding helps in prioritizing containment actions and communicating the severity of the incident. It also aids in post-incident review and improvement of security controls. For deeper insights into post-breach analysis, refer to our guide on digital forensics and incident response.
How do you improve detection coverage?
You improve detection coverage by focusing on technique-level behaviors and reducing reliance on procedure-level signatures. This involves developing detection rules that look for specific behaviors, such as unusual network connections or abnormal file modifications. You should also integrate threat intelligence feeds that provide information on emerging techniques and tactics. Regularly testing your detection capabilities through red teaming exercises helps identify gaps and improve coverage.
Improving detection coverage is an ongoing process. It requires continuous monitoring, analysis, and refinement of detection rules. By focusing on the underlying behaviors and intentions of attackers, you can build a more resilient and effective security posture. This approach aligns with the principles of proactive defense and reduces the risk of undetected breaches.
Key takeaways
- Tactics answer why the attack happens, not how it happens.
- Techniques are observable behaviors that span multiple specific procedures.
- Focusing only on procedures leads to alert fatigue and missed lateral movement.
Focus on detecting techniques rather than procedures to catch evolving threats effectively. Review your detection rules to ensure they map to specific attacker behaviors rather than just known signatures.
Frequently asked questions
Can a single procedure belong to multiple techniques?
Yes, a single procedure can support multiple techniques depending on the context and intent of the attacker. For example, using a legitimate tool like PowerShell can be part of execution, defense evasion, or lateral movement.
Is MITRE ATT&CK the only framework for TTPs?
No, while MITRE ATT&CK is widely adopted, other frameworks exist. However, ATT&CK provides the most comprehensive mapping of tactics, techniques, and procedures across various platforms and environments.
How do I handle alerts for unknown procedures?
Analyze the behavior associated with the unknown procedure to determine the technique and tactic. Look for anomalies in network traffic, process creation, or file access to identify the underlying intent.
Does this apply to insider threats?
Yes, the TTP framework applies to insider threats as well. Insiders may use different tactics, such as data theft or sabotage, but the hierarchical structure of tactics, techniques, and procedures remains relevant for detection and response.
How this guide was produced: written by the Vector Tribune editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
