# IOCs, IOAs & TTPs

> Understand the hierarchy of threat detection. Explore Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and Tactics, Techniques, and Procedures (TTPs), and learn how to build layered detections.

Canonical: https://codelivly.com/rooms/iocs-ioas-ttps
Last updated: 2026-07-05

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive deep into the core building blocks of modern threat detection. The IOCs, IOAs & TTPs module breaks down the critical differences between static artifacts, behavioral attacks, and adversary methodologies.

You will learn why relying solely on IOCs is a failing strategy, how IOAs provide real-time behavioral detection, and how mapping TTPs to frameworks like MITRE ATT&CK creates a mature, intelligence-driven SOC. By the end of this module, you will understand David Bianco's "Pyramid of Pain" and how to layer these indicators to build robust, multi-stage detection rules that force attackers to change their entire methodology.

## Lessons

1. Indicators of Compromise (IOCs) Explained (30 min)
2. Indicators of Attack (IOAs) vs IOCs (30 min)
3. Tactics, Techniques & Procedures (30 min)
4. Building an IOC Watchlist (30 min)

## Related

- [Learning path: Threat Detection and Intelligence](https://codelivly.com/learning-paths/threat-detection-intelligence)
- [All rooms](https://codelivly.com/rooms)