Threat › Module 3 › Lesson 3
IOC vs TTP
IOC vs TTP literacy contrasts brittle indicators with durable behaviors — write comparison card on YOUR $TI_LAB linking lab IOCs to ATT&CK techniques.
Visual · t33_ioc_vs_ttp
IOC vs TTP literacy. $TI_LAB only. Original Cyberlium.
Opening
Block the hash today, hunt the technique tomorrow — literacy teaches when IOCs suffice and when TTP mapping drives detection engineering.
IOCs answer 'what artifact matched?' — fast block, short shelf life. TTPs answer 'what behavior occurred?' — durable hunt and detection rule design. Mature TI pairs both: IOC enriches immediate alert; TTP drives purple-team validation and coverage gaps. Neither replaces the other. Cyberlium writes IOC vs TTP comparison on YOUR $TI_LAB — one lab IOC linked to one ATT&CK technique with detection implication. Next: IOC Lab.
1. IOC vs TTP comparison (named)
IOC strengths: immediate block, SIEM match, low false positive when fresh. IOC weaknesses: rotates quickly, false positive when stale, no context on intent. TTP strengths: behavior detection, hunt hypotheses, ATT&CK coverage mapping. TTP weaknesses: higher engineering effort, tuning required.
On $TI_LAB, write comparison table — one lab IOC and one linked technique with use-case column (block vs hunt).
Command guide
Try these commands — IOC vs TTP comparison (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ STIX — https://oasis-open.github.io/cti-documentation/stix/intro.html OpenCTI knowledge — https://docs.opencti.io/latest/usage/overview/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/notes/ioc-vs-ttp.md" <<'EOF'
# IOC vs TTP — YOUR analyst notes
| Aspect | IOC | TTP |
|--------|-----|-----|
| Lifespan | Short (hours–days) | Long (months–years) |
| Detection | Block/hash/match | Behavior analytics, ATT&CK coverage |
| Example | 192.168.99.1, evil.example.com | T1059 Command-Line Interface |
| Pitfall | Block 8.8.8.8 false positive | Miss if only IOC-focused |
**Best practice:** pair YOUR fake IOCs with ATT&CK technique mapping
EOFCommand — copy this
grep -E 'Lifespan|T1059|ATT&CK' "$TI_LAB/notes/ioc-vs-ttp.md"
python3 -c "print('IOC+TTP pairing: tactical block + strategic detection engineering')"Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); STIX (https://oasis-open.github.io/cti-documentation/stix/intro.html); OpenCTI knowledge (https://docs.opencti.io/latest/usage/overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why analysts need both lenses
SOC tier-1 lives on IOC enrichment for speed. Hunt and detection engineering live on TTP coverage. Incident timelines combine both — artifact match plus technique sequence reconstruction.
Students link lab IOC to technique on notes — production rule deployment follows change control.
3. Lab boundary
Forbidden: blocklist-only program with zero ATT&CK coverage review. Allowed: IOC vs TTP card — comparison plus one linked pair from $TI_LAB inventory.
Ship: IOC vs TTP comparison card for YOUR lab. Next: IOC Lab.
4. What you ship: IOC vs TTP card for $TI_LAB
Comparison table plus one linked IOC-technique pair. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. IOC vs TTP card. $TI_LAB named. File t33-m03-l03-ioc-vs-ttp.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Block stale hashes forever without expiration. Ignore IOC context in hunt-only program.
Right
Write IOC vs TTP comparison for YOUR $TI_LAB. Next: IOC Lab.
Mission: link IOC to TTP on YOUR lab
1) Write IOC vs TTP comparison with strengths and weaknesses. 2) Link one lab IOC to one ATT&CK technique. 3) State block vs hunt use case. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Expire IOCs on schedule — keep TTP detections tuned with purple-team data.
Knowledge Check
APPLY: IOCs primarily enable:
Multiple choice
Knowledge Check
APPLY: True or False: TTP mapping supports durable hunt hypotheses when IOCs rotate.
True or False
Knowledge Check
APPLY: IOC vs TTP literacy on Cyberlium uses:
Multiple choice