TTPs, or Tactics, Techniques, and Procedures, framework the most effective modern threat hunting. Since they are descriptive, they characterize what adversaries are doing, and exactly how they are doing it. Although these characteristics are derived from individual incidents, they can be helpful in developing contextual understanding across a general threat landscape