Tactics, techniques, and procedures represent the behavioral characteristics of an adversary rather than merely individual technical artifacts. A tactic describes the adversary's objective, a technique identifies how that objective is achieved, and procedures represent the specific implementation observed during an intrusion. Consequently, TTP intelligence allows defenders to understand how an attacker operates, including patterns of reconnaissance, persistence, privilege escalation, lateral movement, command-and-control activity, and other operational behaviors.

Options A and B focus primarily on indicators of compromise such as IP addresses and hashes. These are useful for detection, but they are comparatively fragile because attackers can replace infrastructure, change domains, regenerate malware, or modify files to produce different hashes. Option C is broader than an individual IoC, but tools can likewise be replaced or modified. Behavioral knowledge is generally more durable because changing established operational methods imposes greater cost on an adversary.

The CS0-004 objectives explicitly place TTPs, Pyramid of Pain, MITRE ATT&CK, attribution, IoC analysis, and behavioral indicators within threat intelligence and threat-hunting concepts.

Study Guide Reference: Security Operations Threat Intelligence and Threat Hunting TTPs Pyramid of Pain MITRE ATT&CK Behavioral IoCs.