IOC Hunting vs TTP Hunting

What is it?

IOC hunting searches for specific known artifacts (an IP, a hash, a domain) — fast, precise, but brittle: the attacker changes them cheaply. TTP hunting searches for behaviors (how the attacker works: office-app spawns shell, service account logs in interactively) — harder, but durable, because behavior is costly to change.

Why it matters

IOC hunts find the specific attack you already know about; TTP hunts find the class of attack even when the artifacts are new. Programs need both, weighted toward TTP.

Where you see it

The pyramid of pain intuition: IOCs are easy for attackers to swap; TTPs hurt to change.

What normal looks like

A balanced hunt plan: sweep known IOCs quickly, then invest the real time in behavioral TTP hunts.

What suspicious looks like

The same attacker returning with a new IP and hash but the identical technique — invisible to IOC hunting, caught by TTP hunting.

How analysts investigate

By preferring behavioral questions ('what would this technique look like in our telemetry?') over artifact lists whenever durability matters.

Common beginner mistakes

Building a hunt program only on IOC feeds — it goes blind the moment the attacker rotates infrastructure, which is cheap and routine.

Last quarter Qasr blocked IP 203.0.113.44. This quarter the same actor returns from 198.51.100.9 — the IOC hunt finds nothing, but the TTP hunt ('service account interactive logon') catches them instantly, because they still work the same way.

Quick check

Which hunt would still catch an attacker who has rotated all their IPs, domains and hashes?

A quick self-check — it doesn't affect your XP or progress.