1. A computer-implemented method for identifying suspicious singleton files using correlational predictors, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a set of known-clean computing devices that: include no singleton files; and are not infected by malware; detecting at least one software component that is installed on a threshold number of the known-clean computing devices; correlating, based on an analysis of the set of known-clean computing devices, that computing devices are benign when the computing devices have at least one software component installed and do not include singleton files; identifying an unvindicated computing device whose infection status is unknown; determining that, in addition to being installed on the threshold number of the known-clean computing devices, the software component is installed on the unvindicated computing device; determining that the unvindicated computing device includes at least one singleton file; and classifying the singleton file as suspicious in response to determining that: the software component is installed on the unvindicated computing device; and the unvindicated computing device includes the singleton file; and in response to classifying the singleton file as suspicious, performing a security action with respect to the singleton file.