Which concept refers to the patterns of adversary behavior including tactics, techniques, and procedures (TTPs)?

Which concept refers to the patterns of adversary behavior including tactics, techniques, and procedures (TTPs)?

• A. Tactics, techniques, and procedures (TTPs)
• B. MITRE ATT&CK
• C. Kill chains
• D. Threat modeling

Answer: (A)

Patterns of adversary behavior, including the goals attackers pursue and the concrete methods they use to achieve them, are described by tactics, techniques, and procedures. The best term for this concept is Tactics, Techniques, and Procedures (TTPs). This label captures how attackers operate in a repeatable way: high-level goals (tactics), the methods they employ to reach those goals (techniques), and the specific steps they take in practice (procedures). MITRE ATT&CK is a widely used framework that documents these techniques and maps adversaries to them, serving as a knowledge base for understanding TTPs, but it is not the concept itself. Kill chains describe a linear sequence of attack stages, used to model intrusion progression, not the general description of attacker behavior patterns. Threat modeling is the process of identifying and evaluating threats within a system's design and architecture, rather than describing attacker behavior patterns.

Patterns of adversary behavior, including the goals attackers pursue and the concrete methods they use to achieve them, are described by tactics, techniques, and procedures. The best term for this concept is Tactics, Techniques, and Procedures (TTPs). This label captures how attackers operate in a repeatable way: high-level goals (tactics), the methods they employ to reach those goals (techniques), and the specific steps they take in practice (procedures).

MITRE ATT&CK is a widely used framework that documents these techniques and maps adversaries to them, serving as a knowledge base for understanding TTPs, but it is not the concept itself. Kill chains describe a linear sequence of attack stages, used to model intrusion progression, not the general description of attacker behavior patterns. Threat modeling is the process of identifying and evaluating threats within a system's design and architecture, rather than describing attacker behavior patterns.