The threat-hunting concept most concerned with identifying the behaviors of the bad actor is Tactics, Techniques, and Procedures (TTPs). TTPs refer directly to how adversaries operate- their overall strategies (tactics), the ways they execute attacks (techniques), and their step-by- step actions (procedures). TTPs provide deep insight into attacker behaviors, which are used to recognize, categorize, and defend against threat actor activities in an environment.