Tactics, Techniques, and Procedures
TTPs describe how an adversary operates: their goals (tactics), the methods they use (techniques), and the specific implementations (procedures). Threat intelligence and detection teams map observed activity to TTPs, often using the MITRE ATT&CK framework, to understand and anticipate attackers. They matter because defending against behaviors is far more effective than chasing individual malware samples.