In MITRE ATT&CK, what do Tactics, Techniques and Procedures (TTPs) each describe?

Tactics = the WHY (the attacker's goal), Techniques = the HOW (the method used), Procedures = the DETAILS (the exact step-by-step implementation).

The TTP layering moves from abstract to concrete. Tactics answer "what is the immediate objective?" — e.g. gaining initial access or persistence. Techniques answer "by which method?" — e.g. phishing to achieve that access. Procedures are the precise, observed implementation — the specific tool, command sequence or malware a known threat group actually uses. Mapping an attack to TTPs lets a team describe and compare adversaries consistently.

Tip: Mnemonic — Why / How / Details, from goal down to keystrokes.