## Hunting Techniques: Stacking & Clustering

When you have 100 Million log events, you can't read them all. You need data science techniques to find the needle in the haystack.

### 1. Stacking (Frequency Analysis)
Also known as "Least Frequency Analysis".
**Concept**: In a large network, "Normal" behaves the same way. "Evil" stands out because it is rare.

**Scenario**:
You export the "User Agent" string from all web traffic in your company.
1.  **Mozilla/5.0... (Chrome)**: 50,000 counts. (Normal employees).
2.  **Mozilla/5.0... (Edge)**: 30,000 counts. (Normal employees).
3.  ...
4.  **Updates.exe**: 500 counts. (Windows Update).
5.  **Python-urllib/3.8**: 2 counts. (**Suspicious!**)
6.  **Kali-Linux**: 1 count. (**Malicious!**).

You ignore the "Short Stack" (High frequency) and investigate the "Long Tail" (Low frequency).

### 2. Clustering
Grouping data points by shared characteristics to find patterns.
*   **Example**: Grouping all "svchost.exe" processes.
    *   We know `svchost.exe` should usually be spawned by `services.exe`.
    *   If we cluster by "Parent Process", we might see:
        *   Cluster A: Parent = `services.exe` (Count: 9000).
        *   Cluster B: Parent = `explorer.exe` (Count: 1). **MALICIOUS**. Services do not run from explorer.

### 3. Box Plotting (Outliers)
Visualizing data to see who is outside the norm.
*   "Average Data Upload per User per Day": 50MB.
*   "User Bob": 50GB.
Bob is an outlier. He is either backing up his PC or exfiltrating data.