Not every indicator of compromise is equally hard for an attacker to lose — and the ones that are cheapest to collect are also the cheapest for an adversary to throw away.
An Indicator of Compromise (IoC) is a specific, observable artifact tied to one instance of malicious activity — a file hash, an IP address, a domain name. A Tactic, Technique, and Procedure (TTP) is the underlying pattern of adversary behavior — how they gain access, move laterally, and persist, independent of which specific tool or infrastructure they happen to be using this week. The two aren't just different data types; they sit at opposite ends of a scale that measures something concrete: how much it costs the attacker to change it once you've detected it.
The pyramid orders indicators by exactly one variable: the cost imposed on an adversary the moment a defender detects that indicator and denies it. A blocked hash costs a recompile. A blocked IP costs a new VPS lease. A blocked domain costs a new registration. None of those require the attacker to learn anything new — they're operational overhead, not a setback. A detected TTP is different: to stop using "spear-phish with a macro-enabled document, then living-off-the-land binaries for execution, then a scheduled task for persistence," the operator has to change tradecraft they're fluent in, retrain, or find an entirely different way to accomplish the same step. That's why a detection built around behavior — mapped to a framework like MITRE ATT&CK — remains effective across dozens of campaigns that each rotate their hashes and infrastructure daily.
Blocking a single IoC stops that specific artifact, not the campaign behind it. IoCs sit at the bottom of the pyramid precisely because they're trivially rotated — a competent adversary can stand up a new C2 domain, lease a new IP, and recompile their loader to produce a new hash in well under an hour, with zero change to how the intrusion actually operates. An organization that only ever blocks IoCs from threat feeds is running a treadmill: it feels productive (the block count keeps climbing) while the underlying technique — the phishing pretext, the execution method, the persistence mechanism — sails through untouched, because nothing about the defense actually targets it. Durable detection has to include the top of the pyramid: rules and analytics built around behavior (an unusual parent-child process relationship, a specific persistence pattern, a known lateral-movement technique), which keep firing campaign after campaign even as every IoC underneath them changes daily.
Explains the difference between an Indicator of Compromise (a specific, observable artifact like a hash, IP, or domain) and a Tactic, Technique, and Procedure (the underlying pattern of adversary behavior), using a pyramid-of-detection-value model ordered by how costly each indicator type is for an attacker to change once detected.
Both IoCs and TTPs get bundled together as "threat intelligence," and both show up in the same feeds, alerts, and reports, so it's easy to treat them as interchangeable inputs to a detection program. They're not equivalent in durability: an IoC identifies one specific instance of an attack (this hash, this IP, this domain), while a TTP describes the reusable behavior pattern behind potentially many instances — which is why the two require fundamentally different collection, detection, and response strategies.
The pyramid model ranks indicator types by exactly one axis: how much operational cost a defender imposes on the adversary by detecting and denying that indicator. File hashes and IP addresses sit at the bottom because they cost the attacker almost nothing to regenerate — a recompile, a new server lease. Domain names and host/network artifacts cost slightly more but are still largely automatable to rotate. Tools sit higher because swapping an entire offensive framework is disruptive. TTPs sit at the apex because changing a technique the operator is fluent in — the initial access method, the execution chain, the persistence mechanism — requires retraining or redesigning the operation itself, which is a categorically bigger cost than regenerating a file.
IoC-based detection (threat feed blocklists for hashes, IPs, domains) is cheap to operationalize and catches unsophisticated or reused infrastructure, but it degrades fast against any adversary willing to rotate — which is most of them. TTP-based detection, often built around a framework like MITRE ATT&CK, requires more analytic investment (behavioral rules, anomaly baselines, process-lineage analysis) but keeps producing true positives across campaigns that each present completely different IoCs. Mature detection programs run both — IoC feeds for broad, low-cost coverage of known-bad, and TTP-based analytics as the layer that survives an adversary's infrastructure changes.
No — IoCs are still valuable for broad, low-cost coverage (blocking known-bad infrastructure at scale, enriching incident timelines, sharing rapid threat intel across organizations), and for less sophisticated attackers who don't bother rotating. The issue is relying on IoCs alone as a detection strategy against a determined adversary, since rotating them costs that adversary almost nothing.
MITRE ATT&CK is a publicly maintained knowledge base that catalogs real-world adversary tactics, techniques, and procedures (TTPs) — organized by tactic (the adversary's goal, like "initial access" or "persistence") and technique (the specific method used to achieve it). Security teams commonly map their detection rules and incident findings to ATT&CK technique IDs to track TTP-level coverage rather than just IoC-level blocklisting.
Yes — the same offensive tool or framework can be reconfigured with new infrastructure (new IoCs) across many operations while the underlying tactics and techniques it enables remain identical. That's part of why tools sit above IoCs but below TTPs on the pyramid: replacing the tool itself is more disruptive to the attacker than rotating infrastructure, but a technique-level detection is agnostic to which specific tool implements it.
No, they're complementary. Signature/IoC-based detection is fast, cheap, and precise for known-bad artifacts, with a very low false-positive rate. Behavioral/TTP-based detection catches novel infrastructure using known techniques but generally requires more tuning and can be more prone to false positives if the behavioral rule isn't specific enough. Mature programs layer both rather than choosing one.
Colloquially, yes — TTPs are often what people mean when they informally say an attack group has a recognizable "signature" or "fingerprint," referring to their characteristic combination of initial access method, tooling philosophy, and operational patterns, which tend to persist across campaigns even as specific infrastructure and file hashes change.
Try our Cybersecurity Studio
More calculators, simulators, and guides for this discipline.