thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Stack Counting

A hunting technique that counts occurrences of values across many hosts to find rare outliers.

Definition

Also called frequency analysis or long-tail analysis, stacking groups data such as process names, autoruns, services or user agents and sorts by frequency; malicious items often appear on only one or few hosts. It works well at scale with SIEM or EDR data.

Example

Stacking scheduled task names across 5,000 hosts and investigating ones present on only two.

Exam tip

Rare values (the long tail) are the hunting focus.

Related terms