Vulnerability scanning tells you what’s broken. TTP analysis tells you how an attacker actually behaves, which is the more useful question once you’re trying to hunt someone down instead of just patching around them.
Threat hunting is the proactive side of that: looking for an intrusion that’s already happened instead of waiting for an alert to tell you about it. Doing that well means understanding an attacker’s Tactics, Techniques, and Procedures (TTPs) well enough to recognize the pattern even when the specific indicators change.
What are TTPs?#
Tactics are an attacker’s broad goals (gain initial access, escalate privileges, exfiltrate data). Techniques are the specific methods used to reach those goals. Procedures are the concrete, step-by-step implementation of a technique, the exact commands and tooling a given actor actually runs.
The standard reference for cataloging all of this is the MITRE ATT&CK framework, a knowledge base of adversary tactics and techniques built from real-world observed intrusions. ATT&CK assigns each tactic and technique a stable ID, and maintains dedicated group pages (like G0016 for APT29 or G0032 for Lazarus Group) that track which techniques a given actor has actually been observed using. When you’re doing TTP analysis, ATT&CK is what turns “this looks like credential theft” into a specific, citable technique that ties back to known adversary behavior, and gives your report a shared vocabulary with the threat intel and detection engineering teams reading it.
Indicators of Compromise (IOCs), IP addresses, domain names, file hashes, and similar artifacts, are a related but different tool. IOCs are cheap to detect against but also cheap for an attacker to change; TTPs are expensive for an attacker to change, since they’re closer to how the actor actually operates. That’s the core reason TTP analysis holds up better over time than IOC-based detection alone, though the two work best together: IOCs catch a known-bad indicator instantly, TTP analysis catches the behavior even after the indicators rotate.
None of this replaces a layered security program. TTPs, ATT&CK mapping, and IOCs are inputs into that program, not a substitute for it.
TTP analysis#
TTP analysis is the systematic collection and correlation of data (network traffic, system logs, malware samples) to build a behavioral profile of an attacker, then compare that profile against known adversary TTPs.
It has a few distinct uses. For attribution, correlating a specific TTP set against known actors’ documented behavior can point toward who’s likely responsible, though attribution is probabilistic, not a certainty, and low-confidence attribution gets reported as low-confidence. For guiding investigations, a working TTP profile tells investigators where to actually look next instead of chasing every log source equally. For predictive analysis, patterns pulled from historical campaigns can flag what a given actor is likely to try next, shifting response from reactive to anticipatory.
TTP analysis also matters for characterizing exploits. N-day exploits target known, unpatched vulnerabilities; zero-days target vulnerabilities nobody’s disclosed yet. Zero-days in particular tend to be reserved for high-value, resourced operations, so unique characteristics in how one gets deployed (the delivery chain, the post-exploitation behavior) can be a real signal in attributing the operation, even when the vulnerability itself gives you nothing to go on.
It’s slow, resource-intensive work. But it’s what turns a pile of logs and a malware sample into an actual understanding of who you’re dealing with and what they’re likely to do next.
Tools for TTP analysis#
- YARA: rule-based pattern matching for identifying and classifying malware families by shared characteristics.
- Sysinternals Suite: Microsoft’s Windows diagnostic toolset. Process Monitor and Process Explorer cover system activity; TCPView covers active network connections specifically.
- Wireshark: the standard network protocol analyzer, for spotting suspicious connections and unusual traffic patterns directly in a packet capture.
- Empire: a post-exploitation and adversary emulation framework, useful on the defensive side for testing whether your detections actually catch the TTPs it emulates. The original “PowerShell Empire” project was discontinued by its creators in 2019 once Microsoft’s AMSI hardening blunted its approach; BC-Security maintains an active fork that now spans PowerShell, Python, C#, IronPython, and Go agents.
- Metasploit Framework: a Rapid7-maintained exploitation framework, useful here for validating whether a known vulnerability is actually exploitable in your environment, not just theoretically present.
- Threat intelligence platforms: commercial and open-source platforms that aggregate threat data from a range of sources and help correlate it against known TTPs and ongoing campaigns.
None of these are a substitute for the others, and none of them replace a layered detection strategy: TTP analysis, threat intelligence, and vulnerability management all need to be running together.
Examples of TTP analysis#
A look at how TTP analysis actually plays out against real campaigns and threat actors.
WannaCry ransomware#
WannaCry (May 2017) spread by exploiting a Windows SMB vulnerability via the EternalBlue exploit (developed by the NSA, leaked by the Shadow Brokers), letting it self-propagate across networks without any user interaction. Ransom payments went to Bitcoin wallets, which gave the operators a degree of anonymity. Once analysts identified the SMB/EternalBlue chain as the core TTP, the fix was direct: patch the vulnerability (MS17-010) and block the exploit at the network level, which is exactly what happened once the pattern was understood.
APT29 (Cozy Bear)#
APT29 is a Russian state-linked group active since at least 2008, generally assessed to operate on behalf of Russia’s SVR foreign intelligence service. It’s worth being precise about a common mix-up: APT29 conducted an earlier, separate espionage intrusion into the DNC’s network around 2015, but the 2016 email leak itself (via DCLeaks, “Guccifer 2.0,” and WikiLeaks) is attributed to a different group, APT28/Fancy Bear (GRU), per the DOJ’s 2018 indictment of GRU officers. The two groups are often conflated in casual reporting; they aren’t the same actor and don’t share a chain of command.
APT29’s more distinctive, better-documented signature is patient, stealthy espionage rather than noisy disruption. Their standout operation is the 2020 SolarWinds/SUNBURST supply chain compromise: a backdoor slipped into a trusted software update, quietly reaching thousands of downstream organizations including multiple US federal agencies, attributed to APT29 by CISA, FireEye, and Microsoft. The group is also known for abusing legitimate cloud services (Microsoft 365, Azure) to blend malicious traffic into normal business activity, which is a much harder TTP to detect than a phishing email, since there’s no obviously malicious artifact to alert on.
NotPetya#
NotPetya (June 2017) is usually filed under “ransomware,” but functionally it’s a wiper: the ransom mechanism was effectively non-functional (the attacker’s contact email was shut down almost immediately), and encrypted systems had no real path to recovery regardless of payment. That distinction matters more than almost any other TTP detail here, since it tells you the actual objective was destruction, not extortion.
Its initial vector was a supply chain compromise, not phishing: attackers compromised the update server for M.E.Doc, Ukrainian tax and accounting software used by roughly 80% of businesses in the country, and pushed a trojanized update carrying the payload. From there it moved laterally using EternalBlue alongside stolen credentials harvested with a Mimikatz-derived technique, and leaned on living-off-the-land methods, using legitimate admin tools already present on target systems, to avoid tripping traditional antivirus signatures.
Lazarus Group#
Lazarus Group is a North Korean state-linked actor tied with reasonable confidence to the 2014 Sony Pictures hack and the 2017 WannaCry attack (the DOJ’s 2018 indictment of Park Jin Hyok connects both operations to the same North Korean front company). Its early TTPs leaned on spear-phishing, exploited vulnerabilities, and custom, multi-stage malware built specifically to dodge antivirus detection.
More recently, Lazarus has pivoted hard into cryptocurrency theft as a state revenue source. The FBI publicly attributed the March 2022 Ronin Bridge hack (roughly $600 million in stolen cryptocurrency, one of the largest crypto thefts on record) to Lazarus, and the group has continued targeting exchanges and DeFi protocols since. It’s a useful reminder that an actor’s TTPs, and their motivations, aren’t static.
FIN7#
FIN7 is a financially motivated group targeting retail and hospitality businesses through sophisticated spear-phishing campaigns. The DOJ’s 2018 indictment explicitly describes the group as “FIN7, also known as Carbanak,” and there’s real, documented overlap between FIN7 and the malware toolset tracked as Carbanak. That said, Mandiant is careful to note the Carbanak backdoor itself has been used by more than one distinct operator over the years, so “Carbanak malware present” isn’t automatically the same claim as “FIN7 did this.”
FIN7’s own signature moves include using Mimikatz to pull plaintext credentials from compromised systems and leaning heavily on PowerShell for execution, since it’s built into Windows and blends more easily into legitimate administrative activity than a dropped binary would.
Dragonfly 2.0 (Energetic Bear)#
Dragonfly 2.0, also tracked as Energetic Bear, Berserk Bear, or TEMP.Isotope depending on the vendor, is a Russia-linked group that has targeted energy-sector and other critical infrastructure organizations since at least 2013. Its signature malware, Havex, has been distributed through watering-hole attacks and, notably, through a supply chain compromise of at least three separate ICS software vendors, trojanizing legitimate software downloads rather than relying on the target clicking anything.
That supply-chain angle is the group’s most distinctive TTP and the one worth internalizing: it means trusting a vendor’s official download page isn’t automatically safe, which is a harder problem to defend against than a phishing filter can solve.
Carbanak#
Carbanak is a financially motivated group active since roughly 2013, best known for directly commanding compromised ATMs to dispense cash on a schedule for money mules to collect, alongside SWIFT transfer fraud and inflated account balances. Kaspersky’s original research estimated losses across the campaign at up to a billion dollars, spread across roughly a hundred financial institutions in around thirty countries.
Beyond the ATM angle, Carbanak-linked activity has relied on legitimate remote access tools to maintain access, which is effective specifically because those tools aren’t inherently malicious and don’t trip the same alarms a custom RAT would. See the FIN7 entry above for how these two names relate and where the overlap does and doesn’t hold.
Conclusion#
Across every case study here, the pattern that mattered wasn’t the specific IOC, it was the TTP: EternalBlue’s role in both WannaCry and NotPetya’s lateral movement, APT29’s supply-chain patience versus APT28’s noisier operations, Havex’s abuse of trusted vendor downloads, Carbanak and FIN7’s shared toolset and separate identities. That’s the actual value of TTP analysis over IOC-based detection: IOCs rot the moment an attacker changes infrastructure, but a technique tied to an ATT&CK ID stays relevant as long as the actor keeps using it.
Attackers keep evolving their TTPs, which means this isn’t a one-time exercise. Building TTP analysis and ATT&CK mapping into an ongoing threat hunting practice, rather than a report you write once and file away, is what actually keeps pace with them.
