Definition
Adversary behavior refers to the specific techniques, tactics, and procedures (TTPs) that malicious actors use to compromise systems and achieve their objectives. These actions are observable patterns of activity, ranging from initial reconnaissance and exploitation to lateral movement and data exfiltration. Understanding these behaviors allows security professionals to anticipate threats and build more resilient defenses by modeling potential attack paths. For instance, an adversary might use phishing emails to deliver malware, then leverage stolen credentials to move across the network. This differs from simply identifying vulnerabilities, as it focuses on the active exploitation and manipulation of those weaknesses. Knowledge of adversary behavior is crucial for domains like threat intelligence, incident response, and security operations, appearing in certifications such as CompTIA CySA+ and PenTest+.