Stop Hoarding IOCs: Why TTP-Driven Intel is the Only Scalable Defense

Most threat intelligence feeds operate like a municipal security program that publishes a daily list of license plates used in traffic violations three weeks ago. Security operations teams dutifully ingest millions of these atomic indicators—IP addresses, domain names, file hashes—into their SIEMs and firewalls, check off a compliance box, and celebrate their high ingestion metrics. In reality, they are burning compute, flooding analysts with false positives, and chasing ghosts that were decommissioned before the threat feed was even parsed.

The obsession with Indicators of Compromise (IOCs) has turned Cyber Threat Intelligence (CTI) into a digital garbage collection industry. By over-indexing on ephemeral data points simply because they are easy to automate and quantify, security programs build a false sense of security while missing the structural behaviors that define modern attacks.

The Short Half-Life of Atomic Indicators

The fundamental issue with atomic IOCs isn’t that they are wrong; it is that their utility decays almost instantaneously.

Consider the infrastructure operational security of a modern threat actor. An attacker deploying C2 (Command and Control) infrastructure does not rely on static IP addresses or long-lived domains. They spin up ephemeral cloud virtual private servers across commercial providers, leverage domain fronting, utilize fast-flux DNS, or route traffic through compromised consumer routers. A C2 domain registration might exist for only six hours—just long enough to execute initial access, establish persistence, and migrate to a secondary channel. By the time that domain is flagged by automated sandbox telemetry, packaged into a STIX/TAXII feed, ingested by a threat intel platform, and pushed to an edge firewall, the adversary has already abandoned it.

File hashes suffer from an even faster rate of decay. Simple techniques like dynamic compilation, environmental keying, bit-flipping, or appending junk bytes alter a file’s SHA-256 hash without changing a single line of its underlying operational logic. A custom loader compiled specifically for your environment will yield a hash that no threat feed on Earth has ever seen, rendering hash-based blocklists useless against targeted attacks.

Despite this reality, many security organizations allocate the majority of their CTI budget and engineering hours to managing feed ingestion pipelines, resolving indicator conflicts, and managing database scale. They measure success by the volume of indicators processed per day—a metric that correlates with operational overhead, not security outcome.

The Asymmetry of Attacker Economics

To understand why Tactics, Techniques, and Procedures (TTPs) are superior intelligence objects, you have to look at the economics of adversary operations. David Bianco articulated this concept years ago in the Pyramid of Pain, yet defensive architectures are still overwhelmingly built from the bottom up.

Changing an atomic indicator costs an adversary virtually nothing:

• IP Address: A API call to a cloud provider provisions a new IP in under 30 seconds for fractions of a cent.
• Domain Name: Programmatically registered via automated registrars for a few dollars.
• File Hash: Automated build pipelines generate unique hashes for every single target environment automatically.

Now contrast that with what happens when an adversary is forced to change a TTP.

If a detection team engineers a rule that reliably identifies process injection via NTAPI indirect syscalls, or detects unauthorized access to lsass.exe memory through abnormal handles, the adversary cannot solve that problem with a script. They must rewrite their core toolsets, re-test their payload delivery systems against security controls, train their operators on new operational methodology, and alter their standard operating procedures.

Changing a TTP forces the adversary back into an R&D cycle. It injects friction, cost, and risk into their campaign. When you detect and block an IOC, you inconvenience an attacker for thirty seconds. When you detect and break a TTP, you invalidate their playbook.

From Feed Ingestion to Behavioral Detection Engineering

If atomic indicators are largely disposable, what should a modern CTI function actually do?

CTI must transition from a passive data consumption pipeline into an active R&D engine for Detection Engineering and Threat Hunting. Intelligence analysts should spend less time normalizing JSON feeds and more time dissecting adversary methodology to extract telemetry requirements.

Instead of asking: “Do we have the malicious IPs associated with Threat Group X in our threat feed?”

The intelligence-driven question must be: “Threat Group X relies on Kerberoasting for lateral movement in Active Directory environments. Do we have the endpoint and domain controller telemetry required to detect abnormal SPN requests, and do our detections cover variations in ticket encryption types?”

This shift changes the primary deliverables of a CTI team:

1. Behavioral Threat Profiling: Mapping threat actor methodologies directly to the technical chokepoints an adversary must pass through to achieve their objective (e.g., credential access, process execution, service creation).
2. Telemetry Gap Identification: Evaluating whether internal logging captures the behavioral artifacts generated by specific TTPs before an incident occurs.
3. Detection Validation: Partnering with purple teams to execute targeted atomic tests that mirror adversary TTPs, ensuring that existing behavioral rules generate high-fidelity alerts.

When CTI works directly with detection engineers, intelligence stops being an isolated report sent to executive inboxes and becomes an operational input into the security stack.

Pragmatic Architecture for High-Value Intel

Focusing on TTPs does not mean completely discarding atomic indicators, but it requires radically altering how they are handled within your architecture.

First, apply aggressive Time-To-Live (TTL) policies on all network indicators. An IP address ingested from an unvetted threat feed should generally carry an operational lifespan measured in days, not months. If an atomic indicator hasn’t fired in 72 hours, drop it from active firewall blocklists. Stale blocklists degrade infrastructure performance and create complex routing and troubleshooting issues while offering negligible security value.

Second, use IOCs for retrospective hunting, not forward-looking defense. The true value of a newly acquired set of atomic indicators is looking backward through historical telemetry to see if an adversary was present in your environment last week. Ingesting an IOC to block future activity assumes the attacker will reuse infrastructure—an assumption that fails against capable adversaries. Using that same IOC to query 30 days of cold storage endpoint and network logs answers a specific, valuable question: Were we already compromised?

Third, focus on invariant behavioral artifacts. An adversary can change their C2 domain, but if they rely on Windows Management Instrumentation (WMI) to execute payloads remotely, they will generate specific, predictable event logs (such as Sysmon Event ID 19, 20, or 21, or WMI-Activity operational logs). Detections written against these invariant behaviors survive infrastructure shifts, tool re-compilations, and campaign pivots.

Security programs fail when they confuse data collection with intelligence. Ingesting millions of ephemeral indicators gives the illusion of visibility while leaving the fundamental mechanics of adversary tradecraft unmonitored. By shifting focus, telemetry, and budget toward understanding and detecting TTPs, defensive teams turn the operational cost back onto the adversary—where it belongs.