Adversary TTP Evolution & the Value of TTP Intelligence

Scott Small opens by separating indicators, such as command-and-control addresses and domains, from adversary behaviors, meaning the tactics, techniques and procedures attackers use. Using a bank robbery comparison, he argues that behaviors are costlier for attackers to swap out, so defending against them imposes more expense. He presents MITRE ATT&CK as a shared vocabulary for classifying and tracking those behaviors.

The middle of the talk reviews recent shifts. An initial access loader and IcedID both changed their delivery methods within weeks after Microsoft tightened protections on downloaded macro documents, moving to other file types and OneNote. Some ransomware groups have dropped encryption in favor of stealing data and threatening to leak it, which is faster and can be detected earlier in the attack chain. Info stealers have gained defense evasion features and now target multi-factor tokens and cookies, while malvertising has grown as a delivery route.

The closing guidance focuses on turning intelligence into action. Small recommends mapping reports to ATT&CK identifiers, then pulling procedure-level details such as commands and process relationships, which are needed for accurate detections and simulations. He cautions that defenders should consider variations of observed techniques rather than only the exact commands from one campaign. He also argues that publishing this kind of reporting benefits the defender community, despite the risk that adversaries may read it.