Threat › Module 3 › Lesson 2
TTP Named
TTP named literacy covers tactics, techniques, and procedures — map behaviors to ATT&CK IDs on YOUR $TI_LAB notes with fictional lab scenarios.
Visual · t33_ttp_named
TTP literacy. $TI_LAB only. Original Cyberlium.
Opening
Behaviors outlive indicators — literacy names TTPs so you build durable detection on lab scenarios, not one-off hash chasing alone.
Tactics, Techniques, and Procedures describe how adversaries operate — phishing delivery (T1566), PowerShell execution (T1059.001), credential dumping (T1003). TTPs persist when IOCs rotate. ATT&CK provides a shared taxonomy. Procedures are actor-specific implementations of techniques — literacy names all three layers on paper. Cyberlium practices TTP naming on YOUR $TI_LAB — map fictional lab campaign to three ATT&CK technique IDs. Next: IOC vs TTP.
1. TTP layers (named)
Tactic: adversary goal — Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Impact. Technique: method to achieve tactic — e.g., T1566 Phishing. Procedure: actor-specific detail — which lure template, which attachment type.
On $TI_LAB, write TTP card — one tactic, two techniques with ATT&CK IDs, one fictional procedure note for lab actor CYBERLIUM-RED.
Command guide
Try these commands — TTP layers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK techniques — https://attack.mitre.org/techniques/enterprise/ MITRE ATT&CK tactics — https://attack.mitre.org/tactics/enterprise/ CISA — https://www.cisa.gov/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
curl -sS https://attack.mitre.org/tactics/enterprise/ | head -10
cat > "$TI_LAB/notes/ttp-named.txt" <<'EOF'
TTP — NAMED LITERACY:
Tactic: adversary goal (e.g., Initial Access, Command and Control)
Technique: method to achieve tactic (e.g., T1566 Phishing)
Procedure: actor-specific implementation (how APT-X runs T1566)
Why TTPs outlive IOCs: actors rotate infrastructure; behaviors persist
Lab: reference ATT&CK IDs in YOUR mapping notes — curl attack.mitre.org for accuracy
EOFCommand — copy this
grep -E 'Tactic|Technique|T1566|outlive IOCs' "$TI_LAB/notes/ttp-named.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK techniques (https://attack.mitre.org/techniques/enterprise/); MITRE ATT&CK tactics (https://attack.mitre.org/tactics/enterprise/); CISA (https://www.cisa.gov/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why TTP literacy enables durable detection
Hash blocklists fail when samples are re-packed hourly. Behavior detection on technique patterns survives IOC rotation. Hunters write hypotheses in TTP language — 'look for T1059.001 after T1566.'
Students map lab scenarios to ATT&CK on notes — never attribute live victim incidents without authorization and handling rules.
3. Lab boundary
Forbidden: copying live APT procedure details from classified or unauthorized sources. Allowed: TTP named card — tactic, techniques, procedure on $TI_LAB fictional campaign.
Ship: TTP named card for YOUR lab scenario. Next: IOC vs TTP.
4. What you ship: TTP named card for $TI_LAB
Tactic, two ATT&CK techniques, fictional procedure. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. TTP named card. $TI_LAB named. File t33-m03-l02-ttp-named.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Chase hashes only and ignore technique patterns. Copy live APT playbook without scope.
Right
Write TTP named card for YOUR $TI_LAB scenario. Next: IOC vs TTP.
Mission: name TTPs on YOUR lab campaign
1) Pick one tactic and two ATT&CK technique IDs. 2) Write one fictional procedure note. 3) Link to lab IOC from M3-L1 inventory. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
T1059.001 outlives any single malicious hash — build detections on behavior.
Knowledge Check
APPLY: ATT&CK technique T1566 refers to:
Multiple choice
Knowledge Check
APPLY: True or False: TTPs describe adversary behavior and outlive rotating IOCs.
True or False
Knowledge Check
APPLY: TTP named literacy on Cyberlium uses:
Multiple choice