/people-breach-intel

name: people-breach-intel
description: "Breach data lookup, HudsonRock infostealer intel, email-pattern inference, email harvest, Slack/Discord discovery, package registry leaks, and vulnerability prioritization endpoints."
when_to_use: "Use for breach-data lookups (HaveIBeenPwned, DeHashed, IntelX), HudsonRock/infostealer (Cavalier) intel, email-pattern inference and harvesting, Slack/Discord discovery, or package-registry (npm) token leaks."

People, Breach & Intelligence

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only. Never paste PII or credentials into cloud LLMs.

---

BEHAVIORAL CONTRACT

**When triggered:** Breach lookups, username/email investigation, HudsonRock/HIBP/DeHashed queries, email-pattern inference, email harvesting, Slack/Discord discovery, or package registry leak hunting is needed.

**Execute:**

1. Run HudsonRock Cavalier domain lookup (§1) as the first call — highest ROI for external engagements. 2. Cross-reference with HIBP and DeHashed for domain-level breach scope. 3. Apply domain-level breach severity mapping (§1): >=10 employees = CRITICAL, 1-9 = HIGH, >=1 end-user = MEDIUM, 0 named = INFO. 4. If SSO tenants discovered (from `identity-fabric`), intersect with breach corpus for SSO_EXPOSURE findings (§1). 5. For each CVE surfaced, apply the 9-Signal Scoring Rubric (§4.1) to assign a priority tier (P0-P3). 6. For known employee names: derive candidate emails using the 8-pattern template (§2), then harvest from 6 parallel sources (§3). 7. Run Slack/Discord workspace discovery dorks (§6). 8. For package registry targets: run historical-version secret scan workflow (§7). 9. For each finding, emit per `osint-methodology` §3 schema.

**Output:** Breach findings, SSO_EXPOSURE findings, person assets with derived emails, email-harvest results — all per `osint-methodology` §3 finding schema.

**Severity rules:** §1 domain-level mapping. SSO_EXPOSURE = CRITICAL. Open Slack invite = HIGH. Package typosquat = MEDIUM.

**Gating rules:** Never paste PII or credentials into cloud LLMs. Encrypt stealer logs at rest. SHA-256 every artifact. Redact passwords in client reports.

**Chain to:** Receive SSO tenant list from `identity-fabric`. Feed validated emails to `identity-fabric` for GetCredentialType probing. Feed breach hits to `osint-methodology` §12 correlation logic. Feed secrets found in package registries to `secrets-and-dorks` for validation.

---

1. Breach & Leak Data — Highest ROI Sources

• [Have I Been Pwned](https://haveibeenpwned.com/) — breach lookup; Pwned Passwords API (k-anonymity).
• [Dehashed](https://dehashed.com/) — credential search (paid).
• [IntelX](https://intelx.io/) — data intelligence.
• [LeakCheck](https://leakcheck.io/), [Snusbase](https://snusbase.com/), [BreachDirectory](https://breachdirectory.org/).
• **[Cavalier (Hudson Rock)](https://cavalier.hudsonrock.com/) — infostealer log lookups; FREE; highest single-source ROI for compromised employee credentials.**

1.1 HudsonRock Cavalier — Direct API

# By domain (canonical first call)
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq .

# By email (single-account check)
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq .

# By URL (when target's app is the breach victim)
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq .

**Top-level JSON fields:**

• `total` — total stealer entries.
• `employees` — count of `<*>@<domain>` accounts found.
• `users` — count of customer accounts where domain appeared as visited URL.
• `data.employees_urls[]` — `{occurrence, type, url}` — **internal apps where employees were logging in when stolen. Subdomain hits here = recon gold.**
• `data.clients_urls[]` — user-facing apps (reveals undocumented portals).
• `data.stealer_families[]` — which stealer (RedLine / Lumma / StealC / Vidar / Raccoon).

**Free-tier caveats:**

• Subdomains past the first few are **redacted with asterisks**. Pivot to paid tier for unredacted.
• Cleartext passwords + emails are **never** in the free response.
• Rate limit ~1 req/sec/IP.

1.2 Domain-Level Breach Severity Mapping

| Stat | Severity | | --------------------------------------- | ------------ | | ≥ 10 employees compromised | **CRITICAL** | | 1–9 employees compromised | **HIGH** | | ≥ 1 end-user (non-employee) compromised | **MEDIUM** | | Domain in breach with 0 named accounts | **INFO** |

1.3 SSO_EXPOSURE Finding

When a discovered SSO tenant intersects with the breach corpus → `SSO_EXPOSURE` finding, severity **CRITICAL**.

**Legacy-mail-decommissioned pattern (high-value):**

All three together → CRITICAL `SSO_EXPOSURE`:

1. `Resolve-DnsName mail.<domain> -Type A` → NXDOMAIN (legacy gone) 2. HudsonRock corpus has employee URLs against the old host (e.g., `mail.<domain>/owa/`, `/zimbra/`) 3. Current MX → M365 / Google Workspace (DNS confirms migration)

Evidence pack: tenant GUID + breach count + 3+ legacy URLs + autodiscover Microsoft IPs + current MX. Recommend forced password rotation + MFA audit.

---

2. Email-Pattern Inference (TENTATIVE)

Generate 8 candidate addresses for `(first_name, last_name, domain)`:

{first}.{last}@{domain}        # john.doe@example.com
{first}{last}@{domain}         # johndoe@example.com
{first}@{domain}               # john@example.com
{first[0]}{last}@{domain}      # jdoe@example.com
{first}.{last[0]}@{domain}     # john.d@example.com
{last}@{domain}                # doe@example.com
{first}_{last}@{domain}        # john_doe@example.com
{first}-{last}@{domain}        # john-doe@example.com

Lowercase before lookup. Strip diacritics. If Hunter.io shows a dominant pattern, mark FIRM.

---

3. Emai