Stacking and Least-Frequency Analysis

Try it out loud first. Then check yourself:

1. Stacking counts how often each value appears across the fleet (autoruns, services, process paths, parent-child pairs).
2. Attackers are usually rare in a large estate, so the long tail of values seen on one or two hosts is where you look first.
3. Normalize first: strip user names, GUIDs and version numbers from paths, or every host looks unique.
4. Blind spots: rare legitimate software is noisy, and widespread compromise or a poisoned golden image is never rare.

If the interviewer pushes back

• Your stack of scheduled tasks across 20,000 laptops has 900 values seen once. How do you cut that down to something reviewable?

Go deeper

• attack.mitre.org/techniques/T1053/005/