## Hunting Techniques

### 1. Stacking (Frequency Analysis)
The art of counting. "Least Frequency of Occurrence".
*   **Concept**: Bad things are rare. Good things are common.
*   **Method**:
    *   Get all User-Agent strings from Proxy logs (1 million logs).
    *   Group by User-Agent name.
    *   Count them.
    *   **Sort Ascending (Bottom Up)**.
*   **Start**:
    *   `Mozilla/5.0...` (Count: 900,000) -> Legit.
    *   `curl/7.0` (Count: 50,000) -> Devs using curl.
    *   `Python-urllib` (Count: 5) -> **INVESTIGATE**. Why 5? Who is running Python scripts connecting to the web?

### 2. Clustering
Grouping similar objects.
*   You have 1000 processes named `svchost.exe`.
*   Group them by "Parent Process", "Command Line Arguments", and "User".
*   Cluster A: 990 run by SYSTEM, parent services.exe. (Normal).
*   Cluster B: 10 run by "Bob", parent explorer.exe. (Anomalous).

### 3. Baseline Comparison
*   "What is normal for Monday?"
*   Compare this Monday's traffic volume to the average of the last 10 Mondays.
*   If volume is +500%, investigate.

### 4. Grouping (Long Tail Analysis)
Similar to stacking but looking for *unique* values in high-volume datasets.
*   Example: Hunt for rare file extensions executed.
    *   `.exe`, `.dll` (Normal).
    *   `.scr`, `.pif`, `.hta` (Rare and often malicious).
    *   If you see `invoice.scr`, it is almost certainly malware.