What is TTPs?

NIST defines the phrase as the behavior of an actor, described at three levels of detail:

• a tactic is the highest-level description,
• techniques describe the behavior in the context of a tactic,
• and procedures are a lower-level, highly detailed description in the context of a technique.

The wording comes from SP 800-150 and is reused in SP 800-61r3.

MITRE ATT&CK turns those levels into objects you can look up. Tactics are the columns of the matrix and carry TA identifiers; Enterprise ATT&CK has 15 of them, and TA0006 Credential Access is summed up as the adversary trying to steal account names and passwords. Techniques and sub-techniques carry T identifiers. Procedures sit on each technique page in a Procedure Examples table, one row per group, campaign or piece of software seen using it, each tied to the public report behind it.

ATT&CK v19, released in April 2026, split the old Defense Evasion tactic in two. TA0005 kept its ID and is now Stealth, the adversary hiding and blending in with normal behavior. The new TA0112 Defense Impairment covers breaking security tools, pipelines and logging so defenders can't see or trust what is happening. Rule tags and reports written before v19 still say "TA0005 Defense Evasion"; read that label as covering both halves.

Volt Typhoon (ATT&CK group G1017) shows how the levels fit together

ATT&CK describes it as a PRC state-sponsored actor, active since at least 2021, that targets critical infrastructure in the US and leans on web shells, living-off-the-land binaries, hands-on-keyboard activity and stolen credentials. Take one of its moves from the top down.

• Tactic: Credential Access (TA0006).
• Technique: OS Credential Dumping (T1003), sub-technique NTDS (T1003.003), which goes after the Active Directory database on a domain controller.
• Procedure: Microsoft's May 2023 report says the operators frequently tried to use ntdsutil.exe, locally or remotely, to create installation media from domain controllers. That media exists to build new domain controllers, and it holds the usernames and password hashes of the domain, which the actor can crack offline and use to get back in after losing access.

The ATT&CK entry follows the same files into other tactics. The group:

• appended copies of ntds.dit with a .gif extension (T1036 Masquerading, filed under Stealth in v19),
• packed the database into a multi-volume, password-protected 7-Zip archive (T1560 Archive Collected Data, Collection),
• used WMIC for execution and remote system discovery (T1047),
• and built internal proxies with the built-in netsh portproxy command (T1090 Proxy, Command and Control).

Microsoft adds that the group rarely used malware after getting in. Most of what an analyst would have seen was Windows' own tools doing unusual things.

The same T1003.003 page lists other procedures for the same technique.

• APT28 used ntdsutil.exe to export the Active Directory database.
• Mustang Panda created a volume shadow copy with vssadmin to pull NTDS.dit and ran reg save on the SYSTEM hive to help extract it.
• Scattered Spider took NTDS.dit from volume shadow copies of virtual domain controller disks.

All of them sit under the same tactic and technique, and a detection written for one procedure can miss the rest.

Microsoft published a hunting query written at the procedure level:

DeviceProcessEvents
| where ProcessCommandLine has_all ("ntdsutil", "create full", "pro")

It is precise and quiet, and it finds install-media commands similar to Volt Typhoon's. It would never fire on Mustang Panda's vssadmin route. A technique-level version watches the common ways to copy the database instead:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "ntdsutil.exe"
    or (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("create", "shadow"))
    or (FileName =~ "reg.exe" and ProcessCommandLine has_all ("save", "system"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

It is noisier, because backup software creates shadow copies and administrators build install media on purpose, so scope it to domain controllers and review the account and parent process of every hit. Run both. The procedure query tells you whose playbook you are looking at; the technique query catches the next actor who reaches the same goal by a different route.

David Bianco's Pyramid of Pain (2013) explains why defenders bother with the top of that hierarchy. It ranks indicator types by how much it costs the attacker when you deny them: hash values at the bottom, then IP addresses, domain names, network and host artifacts, tools, and TTPs at the apex. Detecting at the apex, in Bianco's words, means operating directly on adversary behaviors rather than on their tools, such as detecting pass-the-hash itself instead of the utility that performs it. The credential theft above ran on a built-in Windows binary. There was no malicious file hash to block, so the behavior was the indicator.