What is the difference between an indicator of compromise and a TTP, and why does the distinction matter?

An indicator of compromise is an artefact — a file hash, an IP address, a domain, a registry key, a mutex — whose presence suggests something malicious happened. A TTP describes behaviour: the tactic is what the adversary was trying to achieve, the technique is how, and the procedure is the specific way this actor implemented it.

The distinction matters because of cost to the adversary, which is what the Pyramid of Pain captures. Changing a hash is trivial — recompile. Rotating an IP or registering a new domain is easy. Changing tooling is expensive. Changing how you operate is hardest of all, because it means retraining people and rebuilding process.

The operational consequence is that detection built on indicators decays in days, while detection built on behaviour lasts months or years. If I tell detection engineering "block these forty IPs", that work is worthless by next month. If I tell them "this actor establishes persistence with a scheduled task that calls a script interpreter from a user-writable directory, here is the telemetry that reveals it, and here is the benign population that will produce false positives", that detection keeps working even after the infrastructure changes.

That does not mean indicators are useless. They are cheap to deploy, they catch the careless, and they are useful for scoping an incident retrospectively. The error is treating a list of them as the product rather than as the starting point for a pivot.