One small box: everyone on your target's threat list, closest to pulling aggro first.
In a party: who holds aggro on top, then everyone else by how close they are to pulling it.