There is No TTP
summary
Argues that “TTP” is a false construct: MITRE ATT&CK mainly models techniques only, leaving tactics and procedures undefined; techniques often describe outcomes not behavior and are too coarse for attribution. Describes building an open source adversary emulation planner that semantically models technique dependencies (requires/provides) to generate ordered attack stages, yet must ignore many ATT&CK entries. Calls for procedures lack IDs and machine‑readable procedure and tactic enumeration, removal of “what you get” techniques, and transforming procedures into detection analytics.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:57There is no TTP
- 4:17We dont know thyself
- 4:38Socrates quote
- 5:44My story
- 6:39Ryan Stillians
- 7:40The Big Breakthrough
- 9:25The Matrix
- 10:35Structure
- 11:10Tactics
- 12:41Ambush
- 13:45Teams Roles
- 17:40Techniques
- 18:53Heatmaps
- 23:05Procedures
- 23:33Attack Object Model
- 27:11Roadmap
- 29:57Questions
related talks
39mThe PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas
01h 47mMITRE ATT&CK Fundamentals
31mAdversary Emulation: Generating MITRE ATT&CK Technique Sequences
41mWhen Knowledge Graph Meets TTPs: Automated & Adaptive Executable TTP Intelligence for Security
28mWho Did It? Getting Started with Threat Actor Profiling
13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...
58mMITRE ATT&CK for Developers
48mMITRE ATT&CK: The Play at Home Edition