Investigation log
Step 01 — Automated pass
Aggregate breach APIs returned clean for @company.tld mailboxes.
Step 02 — Stealer pivot
Domain-scoped infostealer index hit contractor laptop dump — not employee SSO.
Step 03 — Validate
Token format matched internal CI; last commit timestamp aligned with dump date.
This case is synthetic and declassified for training purposes. Methodology reflects how Inquire analysts work; identifiers and locations are fictional.