Threat intelligence
TTP
Tactics, Techniques and Procedures
How an adversary operates: tactics are goals, techniques are methods to reach them, and procedures are the specific implementations seen.
Tactics are the why (credential access), techniques the how (dumping LSASS memory), and procedures the particular way a group does it (a specific tool and command line, run from a particular parent). ATT&CK is the standard catalogue for the first two and records procedure examples per group.
Detecting behaviour rather than artefacts is what makes detections survive infrastructure and tooling changes, because changing how you operate is expensive for an attacker. The trade-off is that behavioural detections are harder to write and tune than an IOC match.