1. At least one machine readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to: monitor activities of objects in a system; compare the monitored activities to metadata for the system; and identify low prevalence outliers to detect potentially malicious activity.