IOC vs TTP: detecting artefacts or detecting attacker behaviour

IOCs match known artefacts like hashes and IPs; TTPs describe how attackers operate. Why TTP detections last longer, with KQL for both.

Short answer

IOCs are cheap to deploy and great for fast sweeps when fresh intel lands, but they decay in days because attackers change hashes, IPs and domains at no cost. TTP detections target behaviour mapped to MITRE ATT&CK, cost more to build and tune, and keep working across campaigns because changing technique is expensive for the attacker. Use IOCs for scoping and retro-hunting, invest your detection engineering in TTPs.

	IOC	TTP
Stands for	Indicator of compromise	Tactics, techniques and procedures
Examples	SHA-256, IP, domain, URL, mutex, registry key	Credential dumping from LSASS, DLL search order hijack
Pyramid of pain level	Bottom to middle (hashes to artefacts)	Top
Cost for attacker to evade	Trivial to low	High: retooling and retraining
Shelf life	Hours to weeks	Months to years
Detection logic	Exact match or lookup	Behavioural, often multi-event
False positives	Low for hashes, high for shared IPs and CDNs	Need baselining and tuning
Source	Threat feeds, STIX/TAXII, incident reports	ATT&CK, red team, incident analysis
Best use	Sweeps, blocking, scoping an incident	Durable detections and hunting hypotheses
Sharing format	STIX 2.1 indicator patterns	ATT&CK technique IDs, Sigma rules

01What each one is

An IOC is an observable left by a specific intrusion: a file hash, a C2 IP, a domain, a URL path, a named pipe. Detection is a lookup, which is why it scales to millions of indicators and why it breaks the moment the attacker recompiles or moves infrastructure.

A TTP describes how an adversary achieves a goal. Tactics are the why (Credential Access, TA0006), techniques the how (OS Credential Dumping, T1003), sub-techniques the specific how (LSASS Memory, T1003.001), and procedures the exact implementation a group uses. Detections target the behaviour the technique cannot avoid, such as a process opening LSASS with read access.

iThe pyramid of pain

David Bianco's 2013 model ranks indicators by how much pain denying them causes an attacker: hash values, IP addresses, domain names, network and host artefacts, tools, then TTPs at the top. The higher you detect, the more it costs them to get around you.

02Same campaign, two detections (KQL)

A report says an actor dumped LSASS using rundll32 with comsvcs.dll MiniDump and gives a hash and two C2 IPs. The IOC query finds this campaign; the TTP query finds anyone using the technique.

IOC: exact matches from the reportkql

let bad_hashes = dynamic(["3f7a0c1e5b9d2f4a6c8e0b1d3f5a7c9e1b3d5f7a9c0e2b4d6f8a0c2e4b6d8f0a"]);
let bad_ips = dynamic(["203.0.113.45", "198.51.100.23"]);
union
  (DeviceProcessEvents | where SHA256 in (bad_hashes)),
  (DeviceNetworkEvents | where RemoteIP in (bad_ips))
| project Timestamp, DeviceName, FileName, SHA256, RemoteIP

TTP: the behaviour, whatever the hash or infrastructurekql

// T1003.001 LSASS Memory via comsvcs.dll MiniDump
DeviceProcessEvents
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "comsvcs"
| where ProcessCommandLine has_any ("minidump", "#24")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName

Rename rundll32.exe and the TTP query misses too, which is why stronger versions also key on ProcessVersionInfoOriginalFileName or on LSASS handle access events. Each layer adds cost for the attacker.

03When to use which

Fresh intel during an active incident: sweep IOCs across all retained data first, it is the fastest scoping tool you have.
Building the detection library: write TTP detections, map each to an ATT&CK technique and track coverage.
Blocking at the edge: IOCs (IPs, domains, hashes) with expiry dates, because they go stale.
Shared hosting, CDNs and cloud IPs: avoid IP IOCs or require a second condition, they generate false positives.
Hunting: start from a TTP hypothesis, and when you find activity extract new IOCs to pivot and sweep.

04Common mistakes

Loading huge IOC feeds with no expiry. Old IPs get reassigned and your alerts fire on innocent tenants.
Counting IOC matches as detection coverage. Coverage means techniques you can detect, not indicators you hold.
Writing a 'TTP' rule that is really an IOC, such as matching a tool's exact filename.
Shipping TTP detections without a baseline. Admin tools legitimately do many of these things; tune per environment.
Not feeding IOCs back. Every incident should produce indicators for sweeps and at least one behavioural detection.

05How to say it in an interview

“How to say it in the room

IOCs are artefacts of a specific intrusion, like hashes, IPs and domains: easy to match, great for sweeping and blocking, but they decay fast because attackers change them for free. TTPs describe how an attacker operates, mapped to ATT&CK, and detections on behaviour like LSASS access keep working across campaigns because changing technique is expensive. I use IOCs to scope an incident and invest detection engineering in TTPs, measured as technique coverage.

Questions people ask

Q1What is the difference between an IOC and an IOA?+

An indicator of attack (IOA) describes behaviour in progress, such as a process injecting into another, rather than an artefact of a known intrusion. In practice IOA is close to a TTP-based detection; the term is mostly used by EDR vendors.

Q2Are IOCs useless then?+

No. They are the fastest way to scope an incident, sweep historical data when new intel arrives and block known bad infrastructure. They are just not a durable detection strategy on their own.

Q3How long do IOCs stay valid?+

It varies by type. Hashes are tied to one build, attacker IPs and domains often rotate within days or weeks, and shared infrastructure can become benign. Give every indicator a source, confidence and expiry date.

Q4How do you map a detection to a TTP?+

Identify the ATT&CK technique or sub-technique the behaviour represents, tag the rule with its ID (for example T1003.001), and record which data source it needs. Sigma rules carry these as tags such as attack.t1003.001.

Q5What format are IOCs shared in?+

STIX 2.1 is the common structured format, usually exchanged over TAXII 2.1, alongside MISP and plain CSV feeds. STIX indicators use patterns such as [file:hashes.'SHA-256' = '...'].

Go deeper

Terms on this page

IOC TTP Pyramid of pain MITRE ATT&CK Sigma KQL Enrichment Pivoting False positive

← All comparisons