TTPs (tactics, techniques and procedures) describe how an attacker operates: the tactic is the goal at each stage, the technique is the method used to reach it and the procedure is the specific way it is carried out. Detecting TTPs works better than chasing single indicators, because an attacker can easily change IP addresses but not the way they operate.
Related term in this glossary: MITRE ATT&CK
tactics techniques and procedures, TTPs, attacker behavior