TTP

Thrombotic Thrombocytopenic Purpura (TTP) is a rare hematologic disorder characterized by microvascular thrombosis, thrombocytopenia, and hemolytic anemia. Severe deficiency of the enzyme ADAMTS13, often due to an autoantibody, leads to accumulation of ultra-large von Willebrand factor multimers and platelet aggregation in small vessels, causing organ ischemia, especially in the brain and kidneys. A typical clinical picture includes fever, anemia with schistocytes, low platelets, and varying degrees of renal and neurologic involvement; not all patients display all features. Diagnosis relies on blood tests showing schistocytes, elevated LDH, low haptoglobin, and markedly reduced ADAMTS13 activity, with normal coagulation studies. Urgent treatment is plasma exchange with fluid replacement to remove autoantibodies and replenish ADAMTS13, often combined with steroids; rituximab or caplacizumab may be used in refractory cases. Prompt recognition and therapy have greatly improved survival from historical rates.

In cybersecurity, TTP stands for Tactics, Techniques, and Procedures, a framework for describing attacker behavior. Tactics are broad goals; techniques are methods to achieve them; procedures are the specific steps and tools used. TTPs help defenders summarize campaigns and guide detection and response. For example, initial access via phishing, credential dumping, and lateral movement through remote services illustrate techniques, with specific procedures varying by campaign. Frameworks like MITRE ATT&CK map such TTPs to understand risk and prioritize defenses. Because adversaries evolve, TTPs are dynamic and should be interpreted in context with other indicators.