Register for our next deep dive! Who is Behind Portal Kombat? Exposing the Pravda Disinformation Machine with OSINT on Thursday, June 27, 2024, at 16:00 CET. Grab your spot now! close
13 Jul 2023

Analyzing Attack Patterns and TTPs

Carlos Fragoso

When a threat actor successfully accomplishes their malicious attempt, chances are they will repeat the process and apply the same methods the next time an opportunity arises to target an unsuspecting organization.

While this may seem daunting, it can also prove to be a double-edged weapon and give us insights into established patterns, opening the door to better analysis of their behaviors.

In this article, we will guide you through methodologies for comprehending attackers’ behaviors and equip you with practical knowledge that your team can incorporate into everyday cybersecurity practices.

Follow Trails of Threat Actors with TTPs 🔗︎

In threat analysis, we need to look at attack patterns or the methods attackers use to achieve their goals. This knowledge will help us recognize and defend against known types of attacks.

We also want to understand the specific steps involved at each stage of an attack. This requires understanding of how attackers operate, in other words, spotting their tactics, techniques, and procedures (TTPs).

What You Should Know about TTPs 🔗︎

TTPs provide us with a practical perspective, allowing us to connect operational data within the same campaign or dots in the tricky and vast cyber puzzle.

The term was borrowed from military and adopted by the cybersecurity industry to describe:

Tactics – High-level objectives of the attack

Techniques – Methods used to achieve those goals

Procedures – Steps taken to deliver a specific technique

If we have a broad enough view and connect the dots correctly, we can attribute TTPs to the same threat actor, understand the threat they pose, and finally, secure our organizational defenses.

TTP analysis is fundamental for proactive and reactive cybersecurity because it provides an understanding of the mindset and capabilities of your adversaries. The TTPs of our attackers do not change often and therefore can be analyzed.

What Methodologies You Can Apply in Your TTP Analysis 🔗︎

One of the most used methodologies is threat modeling, also known as threat profiling. It involves constructing a threat landscape that identifies potential threats that might be relevant to our organization and then dissecting and categorizing them based on their TTPs.

This greatly aids in cyber threat situational awareness and the understanding of the attack vectors that threat actors might employ.

On the other hand, we have other methodologies closely related to incident response and forensic analysis disciplines. These methodologies take the different indicators of compromise (IOCs) discovered during a cyberattack and map them to specific TTPs.

When employing these methodologies, analysts combine snippets of data from many disparate data sources including network data, endpoints, and centralized events, collected in platforms such as Splunk, to investigate and analyze them.

This enhances the effectiveness of containment and eradication of threats during an incident and provides crucial insights during post-incident analysis to comprehend the different stages of the attack and the impact or extent of the breach.

How TTP Analysis Can Benefit Your Team 🔗︎

Based on what we have covered, there is clear value in analyzing the TTPs of a threat actor for at least four reasons:

  1. Risk assessment: Understanding the threat landscape to prioritize cybersecurity investments and develop strategies for managing that risk.
  2. Intelligent Protection: Applying controls and mitigations for the most relevant attack vectors, considering the TTPs of our most probable adversaries.
  3. Proactive Detection: Promptly identifying threat activity to not only contain it, but also gather additional intelligence.
  4. Early Response: Streamlining processes to mitigate threats swiftly and minimize potential damage.

Technical or operational data, such as IOCs (domains, hashes, and others), are merely fingerprints that can easily change from one cyberattack or campaign to another, thus being timely.

On the other hand, TTPs provide tactical information that shapes the threat actor’s behavior which does not change frequently. By understanding the behavior and motivations of the attacker, we can better predict potential future actions or targets and develop a profile of the possible perpetrators behind these attacks.

Be Aware of the Common Attack Patterns and TTPs 🔗︎

Attack patterns or TTPs might vary from one organization to another. This only goes to show that the threat landscape, including the existing threat actors that evolve over time, depends also on who we are and where we operate.

While it may be challenging to compile a definitive list of the most common patterns, several techniques have been extensively used in recent years in global cyberattacks targeting organizations across various industries, irrespective of their specific sector.

These techniques include amongst others:

  • Phishing: e.g., deceiving recipients into providing login credentials by clicking on malicious links
  • Drive-by Downloads: e.g., exploiting vulnerabilities in the user’s web browser
  • Ransomware: e.g., demanding payment in exchange for a decryption key or to avoid leaking the victim’s data
  • Living-off-the-Land (LOTL): e.g., use of system binaries and tools instead of malware to avoid detection through masquerading
  • Remote Code Execution (RCE): e.g., abusing existing software vulnerabilities to force the execution of malicious payloads
  • Information Stealing: e.g., collecting credentials and other personally identifiable information (PII) that might be used to abuse or target other systems or platforms
  • Command and Control (C&C) Frameworks: e.g., use of commercial or open-source C&C software to flexibly operate compromised systems

There are also different security vendors, cybersecurity agencies, and other relevant stakeholders who make predictions based on the collected intelligence regarding trends within their customer base or service constituency. These predictions are then released in annual reports that provide current information about these trends. For example, top resources include:

While predicting future events is difficult to incorporate into cybersecurity workflows, identifying unseen gaps or potential next steps can be facilitated by using what you may already have at your fingerprints – historical attack data.

Use Historical Attack Data to Profile Future Attackers 🔗︎

One of the most common mistakes in cyber teams is overlooking the importance of keeping a record of the encountered cyberattacks.

There is a misguided notion that relevant agencies and intelligence providers are the only ones proficient enough and responsible for collecting and understanding the necessary intelligence data. And yet, there is no substitute for the intelligence gained from your own systems and data sources.

While individual attacks or attempts may not seem significant in isolation, studying them collectively as part of campaigns can make a difference.

Here’s where you can start:

  1. Design cybersecurity functions that allow you to incorporate external intelligence for prevention, detection, and response to various threats.
  2. Encourage your detection, response, and forensic analysis teams to gather additional indicators and thoroughly analyze them, as this will help generate internal intelligence.
  3. Utilize the internal intelligence you gather to enhance your mitigation efforts, strengthen your detection mechanisms, and foster a culture of continuous learning within your team.
  4. Take advantage of the information at your disposal to create accurate profiles that give you a better understanding of the motivations and potential targets of threat actors.

Historical data can serve as a baseline for comparison and help you make sense of ongoing activities. So, the more information you have, the better you will understand the attacker’s motivations and potential targets.

That being said, let us see what measures we can take to streamline our analysis.

Build a Toolkit for Your TTP Analysis 🔗︎

Today, we cannot discuss TTPs without mentioning the MITRE ATT&CK Framework. It serves as the industry standard and offers a knowledge base comprising common adversary tactics and techniques based on real-world observations of cyberattacks worldwide.

Both proactive and reactive cybersecurity tools have aligned their detections and references with this standard, facilitating the understanding and use of cyberattack information. One invaluable tool is the ATT&CK Navigator, which aids in annotating and exploring the framework matrices.

When analyzing TTPs, you may also want to improve the process of consolidating various pieces of information with STIX. It is the most relevant industry standard being used as a universal language that assists in the definition and exchange of Cyber Threat Intelligence (CTI) information among team members, making your workflow more interoperable and efficient.

When it comes to blue teams, they often want to assess if they have good visibility or coverage of the TTPs used by threat actors. To score and compare data log source quality, they can use handy tools such as DeTTECT. Alternatively, some teams may opt for tools like Decider. It offers guidance questions to help analysts map adversary behaviors to the framework.

There is also a growing landscape of cyber threat intelligence tools, both open-source and made by vendors, that can effectively assist in visualizing, mapping, correlating, and dissecting TTPs to better understand and respond to cybersecurity threats.

There are different tools you can use to work with threat intelligence data. One of the most common and extended tools are Threat Intelligence Platforms (TIPs). If you want to get your hands dirty with them, you should have a try with MISP or OpenCTI. Both will provide you with a way to collect, manage, and disseminate intelligence across your organization and with other stakeholders.

Learn about Other Methods to Track Digital Traces of Your Adversary 🔗︎

In summary, analyzing TTPs gives you a deeper understanding of attackers’ moves and can help you spot anomalies and even forecast future attacks, leading to more effective daily operations.

At the same time, the sheer volume of information can feel overwhelming, and factors like limited time and resources can hinder the flow even if you are equipped with reliable methodologies and automation tools.

One idea to address these challenges is to use an all-in-one platform for data mapping and visualization to help you anticipate threats that may come your way.

For a comprehensive guide on analyzing attack patterns and TTPs and utilizing Maltego to streamline the lifecycle of threat intelligence, along with other common use cases, check out our handbook for Cyber Threat Intelligence below.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

If you found this article useful and would like to learn more about cyber threat intelligence investigations or other related topics, you can follow us on Twitter and LinkedIn, or subscribe to our newsletter.

Happy investigating!

About the Author 🔗︎

Carlos Fragoso

Carlos is the Principal Subject Matter Expert and Lead Instructor at Maltego with over 20 years of professional experience in information security: Incident response, digital forensics, threat intelligence, and threat hunting. A curious and passionate investigator working with big companies and LEAs to tackle cybercrime around the world (Europe, Middle East, LATAM) SANS Institute Instructor.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.