CyberTap logoCyberTapby Cert Tap
← Threat Intelligence

Threat Intelligence · 5 min

TTPs & MITRE ATT&CK

A shared language for attacker behavior

This lesson explains the concept, then checks your understanding in a short interactive exercise.

Tactics, techniques, procedures

TTPs describe attacker behavior at three levels of detail.

  • Tactic — the goal: get in, persist, steal credentials
  • Technique — the general method used to achieve it
  • Sub-technique / procedure — the specific variation an actor actually performed

What ATT&CK is

MITRE ATT&CK is a publicly available knowledge base of observed adversary behavior, organized by tactic and technique. Its main value is a common language: teams, vendors and reports can describe the same behavior the same way.

  • A knowledge base, not a product
  • A shared vocabulary, not a maturity score
  • Built from observed real-world behavior

Loading the interactive lesson…