In cyber threat intelligence analysis, extracting attackers’ tactics, techniques, and procedures (TTPs) is crucial for enhancing an organization’s speed in identifying and responding to cyber attacks. The MITRE ATT&CK framework, a knowledge base of adversary behavior, serves as the foundational taxonomy for most TTPs classification studies. As the number and complexity of cyberattacks grow, the tactics and techniques employed by attackers also evolve, driving continuous updates and iterations of the ATT&CK framework to cover new threats. However, the current TTPs classification models are predominantly static and heavily dependent on fixed versions of the ATT&CK framework. This limits their ability to adapt efficiently to updates in the knowledge base, as they struggle to balance model performance, efficiency, and parameter scale. To address this issue, this paper proposes an incremental learning model named IncreTTP for TTPs. This model is based on data replay methods and uses two types of knowledge distillation: multi-label distillation and label semantic distillation, achieving stable generalization capabilities across multiple versions of the ATT&CK framework. Our experiments show that using up to 5% replay data yields a model with \(F_1\) performance comparable to traditional models trained on full datasets, while reducing training time and computational cost by over 78% and 34%, respectively.