Understanding Tactics, Techniques, and Procedures

This article provides an overview of Tactics, Techniques, and Procedures (TTPs) used by threat actors—defining tactics, techniques, and procedures, listing common examples (phishing, lateral movement, remote code execution, etc.), calling out key TTPs observed by Arctic Wolf Labs (e.g., PowerShell command interpreter, ingress tool transfer, WMI, command obfuscation, SEO poisoning), and outlining defensive recommendations such as visibility, identity and access management, cloud hardening, and continuous monitoring.