Examples indicators attack TTPs behavior show why modern threat detection must go beyond static Indicators of Compromise (IOCs). While malicious IPs, file hashes, and domains remain useful, attackers can quickly replace them. Their tactics, techniques, procedures, and behavioral patterns are much harder to hide.
Network Threat Detection helps security teams identify these ongoing attack behaviors through continuous visibility and contextual analysis. In this article, you’ll learn how behavioral detection uncovers threats earlier than IOC-based monitoring alone. Keep reading.
What You’ll Learn
This article explains the key differences between IOC-based detection and behavior-based threat hunting. You’ll also see practical examples of attack behaviors that security teams should monitor.
- IOCs like hashes and IPs are ephemeral; TTPs and behaviors are recurring patterns that identify an attacker’s methodology regardless of their changing tools.
- Lateral movement, command-and-control beaconing, and data staging leave clear behavioral trails in network traffic that IOCs often miss completely.
- Proactive detection requires baselining normal activity so you can spot the anomalies that signal everything from phishing to data exfiltration.
What’s the Difference Between an IOC and a TTP?
You get an alert: a file with a known-bad MD5 hash was detected. You quarantine it. That’s an Indicator of Compromise (IOC). It’s a piece of forensic evidence, a fingerprint left behind.
Now, imagine you see a user’s workstation, one that never does this, start making repeated DNS requests to a series of algorithmically generated domains like xkjhf83d.cloudservice[.]com.
That’s not an IOC, that’s a Technique.The behavior of calling to DGA domains is the TTP, making it easier to identify attacker tactics and techniques within the MITRE ATT&CK matrix instead of relying on short-lived indicators.
We learned to spot this distinction during an incident response. We found a malicious PowerShell script (IOC: the script hash). But the more valuable find was the behavior: the script was launched via a scheduled task immediately after a user clicked a phishing link, and it used Invoke-WebRequest to download a second payload.
The hash was unique. The TTP chain, “Phishing,” “Scheduled Task,” “Scripting,” “Ingress Tool Transfer”, was straight out of a common playbook.
Focusing on the TTPs let us find other systems where the same behaviors occurred, even though the file hashes were completely different, making it easier to apply the MITRE ATT&CK framework across similar attack patterns.
- IOC: A static data point (Hash, IP, URL).
- TTP: The adversary’s method or behavior (Phishing, Credential Dumping, Lateral Movement).
- Key Advantage: TTPs are persistent; IOCs are transient.
Can You Show Me a Real Example of Malicious Behavior?
Imagine an attacker has phished credentials and is now inside a workstation. The story plays out in the network traffic.
- Initial beacon. The compromised machine makes an outbound connection on a strange port (like 4444) to an external IP address. This is the “call home.”
- Command channel. Small, regular packets then flow out to that IP every few minutes. It’s a heartbeat, a waiting channel for instructions.
- Lateral movement. The traffic shifts. The infected host starts rapidly trying to connect to dozens of other internal machines on port 445 (SMB). It’s knocking on doors, searching for the next system to compromise.
- Data theft. Finally, a connection to an internal file server is made. A large, sustained data transfer moves from that server back to the initial workstation, before being sent outbound. The data is gone.
“To fight modern ransomware, organizations must shift from chasing IoCs to detecting attacker behaviors, known as Tactics, Techniques, and Procedures (TTPs). TTPs are challenging for attackers to modify because they represent core behavioral patterns and strategic approaches, unlike IoCs which are surface-level elements that can be easily altered. This shift is reinforced by the so-called ‘Pyramid of Pain’, a conceptual model that ranks indicators by how difficult they are for adversaries to alter.” – SecurityWeek
You don’t need a known virus hash to see this. The sequence of anomalies, beacon, heartbeat, lateral probe, theft, is the clear story of an active intrusion.
We see it often. In one case, a desktop began slow, low-volume calls to an IP in a country we don’t operate in. That behavioral oddity, persistent calls to a high-risk location from a user’s desktop, was the thread we pulled. It revealed an intrusion that had been active for months.
What Does Lateral Movement Look Like on the Network?
Lateral movement is the attacker’s journey through your network after the initial breach. It’s how they go from a low-level user’s laptop to a domain controller or a database server. IOCs are terrible at catching this.
The tools used are often legitimate system admin tools, PsExec, Windows Management Instrumentation (WMI), PowerShell Remoting. Their hashes are clean. Their signatures are Microsoft’s. But their use, in a specific context, is malicious.
After an initial breach, an attacker moves internally. They use legitimate tools, PsExec, WMI, PowerShell, with clean, Microsoft-signed hashes. Detection relies on spotting their misuse in context.
We watch for three key behavioral patterns.
- Unusual authentication. A single user account, especially a non-admin one, successfully logging into 15 different servers in 10 minutes is a major red flag. Network logs show a flood of Kerberos or NTLM attempts from one source IP to many destinations.
- Protocol abuse. Look for internal spikes in SMB or RDP traffic from one host to many others. A workstation making rapid RDP attempts to a dozen finance servers isn’t acting like a person; it’s acting like a scanner. Attackers use tools like CrackMapExec for credential spraying, which creates a distinct pattern of rapid, sequential SMB authentication attempts.
- Unexpected tool transfers. You might see a compromised workstation download a portable hacking tool like Mimikatz from the web. Minutes later, that same machine uses SMB to transfer a file to a domain controller. The attacker is moving their toolkit toward high-value targets.
The following table shows the difference between looking for simple indicators and analyzing this full behavior.
| Attack Phase | What an IOC Might Catch | What Behavioral/Network Detection Sees |
| Credential Access | Hash of a credential-dumping tool (e.g., Mimikatz). | Multiple failed logins followed by a successful one from a new IP, then immediate use of that account elsewhere. |
| Discovery | IP of a known network scanner. | A single internal host making rapid, sequential connections to hundreds of other internal IPs on ports 445 (SMB) or 3389 (RDP). |
| Lateral Movement | File hash of PsExec. | Legitimate PsExec or WMI commands being launched from a user’s workstation to multiple servers, especially at odd hours. |
| Collection | Filename of a compressed archive. | Large volumes of data being copied from multiple servers to a single “staging” server before a consolidated outbound transfer. |
How Does Behavioral Detection Find Phishing and Insider Threats?
Credits: LecturesHub
Phishing and insider threats are two sides of the same behavioral coin. Both involve a trusted entity, an email address or a person, acting in a way that violates their normal pattern to cause harm. IOC-based email gateways catch a lot of phishing by looking at known-bad URLs and attachments.
A user who never accesses the corporate SharePoint from outside the country suddenly authenticates from an IP in a foreign location 2 minutes after clicking a link in a suspicious email. That’s a behavioral chain: Email Click → Unusual Geo-Login.
The network sees both the click (HTTP request to a new domain) and the subsequent, geographically improbable authentication event. Correlating these two unrelated events is a job for behavioral analytics, not an IOC block list.
Insider threats are even more subtle. There’s no malicious hash. It’s an employee using their legitimate access in an illegitimate way. The signals are all deviations from their personal baseline.
Does a marketing employee who only touches design files suddenly start querying the customer database at night? Does an engineer who typically transfers small code files start uploading gigabytes of data to a personal Google Drive? These are volumetric and contextual anomalies.
We helped a client spot an insider risk not by finding a virus, but by noticing a pattern. An employee’s workstation began generating encrypted outbound traffic every Friday afternoon, just before logoff. The volume was significant, and the destination was a personal cloud storage provider not used by the company.
Why Is Network Data the Best Source for Behavioral Detection?
The endpoint can lie. Logs can be turned off. A clever attacker can disable logging or manipulate local system artifacts. But the network? It’s a witness. Every connection, every packet transfer between points A and B, is a fact.
Network detection gives you the unbiased truth of communication. It shows the conversation between the compromised server and the attacker’s C2, even if the server itself has been told to forget.
“Behavioral IOCs are key indicators based on patterns of activity that suggest malicious intent… If Tactics, Techniques & Procedures (TTPs) describe what an attacker does, behavioral IOCs are how we know they’ve done so in a given environment. Actions or series of actions that are specific to a known actor or tool. Generic identifiers of TTPs, not specific to a known actor or tool.”– Wiz.Io
It reveals the lateral movement from department to department as a clear map of connections. It highlights data exfiltration as a stark, unmissable spike in outbound traffic volume. This visibility is holistic. An endpoint tool only sees its own host. A network sensor sees the interaction between all hosts, the very fabric of the attack.
This is where we build our detection logic. Not on a list of bad things, but on a model of normal things, and then we look for the outliers. The power isn’t in any single event, but in the correlation of events across the network that tell a story no single log source could, helping teams better align security controls with observed attacker behavior.
FAQ
Aren’t behavioral detections just more expensive and complex?
They can be if you try to build from scratch. The complexity is in the analytics engine, not in your day-to-day use. The right platform does the heavy lifting of baselining and anomaly detection, presenting you with high-fidelity behavioral alerts, not raw data. The cost of missing a breach is almost always higher.
How do you avoid false positives with behavioral detection?
You don’t avoid them entirely; you manage them. It’s a tuning process. You start with broader detections, see what they catch, and refine the rules to match your specific environment. A false positive is a learning opportunity to better define “normal” for your network.
Do we need to replace our EDR or antivirus?
No. Think of it as a force multiplier. Your EDR sees the detail on the endpoint. Network detection sees the conversation between endpoints. When an EDR alert fires, network data can instantly show you what other systems that compromised host talked to, revealing the full scope in seconds.
Can a skilled attacker hide their network behavior?
They can try, using encryption, slow data rates, or common protocols. But hiding all behavioral signals is incredibly difficult. Even encrypted traffic reveals metadata (size, timing, destination).
Slow exfiltration is still an anomaly over time. Using common protocols (like HTTPS) for C2 often means communicating with new or suspicious domains. The goal is to raise their cost and time, making detection probable.
From Artifacts to Actions: Detecting Real Attack Behavior
Attackers don’t rely on the same malware hash or IP address forever, but they often repeat the same behaviors. That’s why NetworkThreatDetection.com helps security teams detect attacks through real-time threat modeling, continuous intelligence, and behavior-focused analysis.
By revealing attack paths, mapping risks, and supporting faster investigations, the platform helps teams identify threats before they escalate. Explore how it can strengthen your detection strategy by joining here: Join Network Threat Detection
References
- https://www.securityweek.com/how-ttp-based-defenses-outperform-traditional-ioc-hunting/
- https://www.wiz.io/blog/detecting-behavioral-cloud-indicators-of-compromise-iocs
