Foundation glossary/Threat intel
TTPs
Companion card for the Foundation course — study the related lesson for full progress.
Simple explanation
How attackers behave — their playbook.
Technical explanation
Tactics, Techniques, Procedures (often MITRE ATT&CK).
Real-life scenario
Same gang always sends ‘KYC expire’ SMS then asks OTP — that pattern is a TTP.
Security relevance
TTPs let blue teams detect behavior, not only disposable IOCs.
Practical example
T1110 brute force; T1059 scripting.
Tactic
Technique
Procedure
Mini quiz
Repeated ‘KYC expire’ SMS → OTP harvest is best called a:
Related lesson
No direct lesson slug yet — use the Foundation course syllabus or roadmap level threat-intel.