TTP
acronymsecuritygovernance & risk
Stands for: tactics, techniques, and procedures
Tactics, techniques, and procedures: the layered description of how a threat actor operates.
The layers ascend in specificity: a tactic is the goal (gain initial access), a technique is the general method (phishing), and a procedure is the concrete way this actor does it (a lure impersonating a specific vendor with a particular payload). TTPs are the most durable thing you can track about an adversary, because they can rent new infrastructure overnight but cannot easily change how they think, which is exactly the insight behind MITRE ATT&CK. Compare the shorter-lived IoC.
Also known as: tactics techniques and procedures, TTPs