TTP Tactics, Techniques, Procedures
How an attacker operates — strategically (tactic), methodically (technique), concretely (procedure).
Hierarchy: tactic = goal ("gain initial access"), technique = the way ("phishing"), procedure = exact tooling ("Cobalt Strike + invoice file"). MITRE ATT&CK structures TTPs. Defence: detect at the TTP level (hard to change) > IoC level (easy).