An indicator of compromise, or IOC, is a specific artifact from one attack, such as a file hash, an IP address or a domain name. A TTP, short for tactics, techniques and procedures, describes how an attacker operates. IOCs are quick to match but expire fast. TTPs take longer to detect but last.
What each one looks like
IOCs are things you can put in a list and match: a hash, an address, a domain, a registry key, a file name. NIST describes cyber threat information more broadly as data that helps organizations detect, evaluate, monitor and respond to threats, and lists compromise indicators and attacker methods as two of its parts.
TTPs are patterns of behavior. MITRE ATT&CK breaks them down this way: tactics are the why, the attacker's goal such as credential access; techniques are the how; sub-techniques are a more specific version of the how.
Why IOCs go stale
Attackers change infrastructure and rebuild files, so yesterday's address may be harmless or reassigned tomorrow. That is not a flaw in the idea. It is a reason to attach an expiry date and a confidence level to every list entry, and to remove old ones.
Why TTPs take effort
Behavior detections need good logs and careful rules. Normal software sometimes does the same things as attackers, so rules produce false positives until they are tuned. The payoff is that an attacker has to change habits, not just a server.
A side by side example
Take credential theft from memory on Windows. An IOC approach matches the hash of one known tool. A TTP approach looks for an unusual process opening a handle to the Local Security Authority process, which is how MITRE describes the technique called OS Credential Dumping: LSASS Memory. The second approach catches renamed or new tools doing the same thing.
How to use both
- Use IOCs for fast triage and for scoping an incident: which hosts touched this address?
- Use TTPs for durable detections and for hunts.
- Record where each detection came from, and when it should be reviewed.
- When a threat report arrives, extract both. Load the IOCs, then ask which behaviors the report describes and whether you can already see them.
Common mistakes
Treating a public feed as truth without checking age or source. Blocking on an address that is a shared hosting provider. Writing a behavior rule with no test data, then ignoring it when it is noisy.
Quick check
Is a malware family name an IOC?
Not on its own. It is a label for a group of related activity. IOCs are the concrete artifacts you can match in your own data.
Do I need both?
Yes. IOCs answer "did we see this known thing" and TTPs answer "did something behave like an attack." They fail in different ways.
Sources
- NIST SP 800-150, Guide to Cyber Threat Information Sharing
- MITRE ATT&CK FAQ
- MITRE ATT&CK T1003.001 LSASS Memory
Last reviewed: 19 October 2026.
