Which term defines historical analysis of cyber attacks and the actions of adversaries?

Which term defines historical analysis of cyber attacks and the actions of adversaries?

• A. Forensics
• B. Threat modeling
• C. Tactics, techniques, and procedures (TTPs)
• D. MITRE ATT&CK

Answer: (C)

TTPs, or Tactics, Techniques, and Procedures, are the patterns of attacker behavior across cyber campaigns. When you analyze historical cyber attacks, you’re looking at the tactics adversaries aimed for, the techniques they used to accomplish them, and the specific procedures or tools they employed along the way. This way of thinking lets you summarize how attackers operate, compare incidents, and anticipate how similar campaigns might unfold in the future. MITRE ATT&CK is a framework that catalogs these TTPs to help analysts map observed actions to a standardized set of behaviors, but the concept you’re identifying is the TTPs themselves—the description of how adversaries act. Forensics deals with collecting and examining evidence from a single incident, while threat modeling focuses on identifying potential threats and designing defenses in advance.

TTPs, or Tactics, Techniques, and Procedures, are the patterns of attacker behavior across cyber campaigns. When you analyze historical cyber attacks, you’re looking at the tactics adversaries aimed for, the techniques they used to accomplish them, and the specific procedures or tools they employed along the way. This way of thinking lets you summarize how attackers operate, compare incidents, and anticipate how similar campaigns might unfold in the future. MITRE ATT&CK is a framework that catalogs these TTPs to help analysts map observed actions to a standardized set of behaviors, but the concept you’re identifying is the TTPs themselves—the description of how adversaries act. Forensics deals with collecting and examining evidence from a single incident, while threat modeling focuses on identifying potential threats and designing defenses in advance.