Desktop
Step-by-step workflow guide for investigators
Organizational Risk Assessment
Starting from a single domain, this guide walks you through establishing what an organisation is already exposing — employee credentials circulating in infostealer logs, the full scope of what a compromised device gave up, and the identities behind the records. Run it against your own domain to find where staff data has leaked and what operational risk that creates, or against a prospective partner or supplier to establish whether their exposure would become your supply chain problem.
Who is this for?
Security and threat intelligence teams, third-party risk and procurement functions, and risk consultants assessing organisational exposure. There are two distinct triggers for this workflow, and they lead to the same steps with different reporting:
Assessing your own organisation — establishing whether employee credentials and personal data have leaked, which devices are compromised, and what operational risk that creates. The output drives remediation: forced resets, endpoint investigation, and staff notification.
Assessing another organisation — establishing, before entering into a relationship, whether a prospective partner, supplier, or acquisition target carries exposure that would reach you. The output drives a decision: proceed, proceed with conditions, or decline.
Assessing your own organisation — establishing whether employee credentials and personal data have leaked, which devices are compromised, and what operational risk that creates. The output drives remediation: forced resets, endpoint investigation, and staff notification.
Assessing another organisation — establishing, before entering into a relationship, whether a prospective partner, supplier, or acquisition target carries exposure that would reach you. The output drives a decision: proceed, proceed with conditions, or decline.
What is on this page?
A video walkthrough of a real case, followed by step-by-step guide in Maltego Graph (Desktop).
A step-by-step guide for using Maltego Graph (Desktop) to assess an organisation's existing exposure from its domain alone. The workflow covers searching infostealer logs for stolen employee credentials, extracting the identities and target services behind those records, drilling into a single infected endpoint to establish the full scope of one compromise, pivoting to the individual affected, and checking the domain against broader dark web leak records.
A step-by-step guide for using Maltego Graph (Desktop) to assess an organisation's existing exposure from its domain alone. The workflow covers searching infostealer logs for stolen employee credentials, extracting the identities and target services behind those records, drilling into a single infected endpoint to establish the full scope of one compromise, pivoting to the individual affected, and checking the domain against broader dark web leak records.
How to use this page?
Watch the video at the top for an end-to-end overview, then follow the written steps below to conduct an investigation using your own domain.
New to Graph?
No problem. Every platform feature mentioned in this guide links to the relevant product documentation so you can read up as you go.
A note on results
The steps here reflect what works for most customers in this use case. Because Graph (Desktop) works with live data, results depend on what is actually available at the time you run Transforms. Maltego cannot guarantee the same outcome for every case.
Data providers used on this page
This workflow uses two dark web data providers with overlapping coverage. For most steps either will work, and running both gives you corroboration where their sources differ.
Darkside D4 — dark web data including infostealer log search. Given a domain, the stealer log search returns records where a login or username contains that domain as an email address, along with the malware family or command-and-control source the record came from. Also returns leaked records associated with a domain.
Darkside D4 — dark web data including infostealer log search. Given a domain, the stealer log search returns records where a login or username contains that domain as an email address, along with the malware family or command-and-control source the record came from. Also returns leaked records associated with a domain.
DarkOwl — a broad dark web index covering onion sites and other underground sources. Used here to return leaked records associated with a domain, surfacing exposed email addresses at scale.
Access to infostealer log data is restricted to Enterprise plans
If you are on any other plan, start with Step 3.
Before you start:
Identify the starting point
Domain you are trying to investigate.
Access
- Download and install Graph (Desktop).
- Install the Darkweb and Person of Interest Data Pass modules from the Data Hub within Graph (Desktop).
Note: Stealer log data is restricted to Enterprise plans. Basic users have limited access to the data providers used in this workflow more generally — some transforms may be unavailable or return restricted results depending on your plan tier.
Resources
This guide assumes basic familiarity with Graph (Desktop). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
Video Overview
Watch an organizational risk assessment workflow demonstration. Then follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Search stealer logs for stolen credentials
Infostealer malware harvests saved credentials from infected machines, and those logs circulate in underground markets. This search asks whether any of them contain logins tied to the organization's domain.
How to:
How to:
- Add the Domain Entity to the graph.
- Open the Transform menu by right-clicking on the Entity.
- Navigate to Person of Interest → D4 - Stealer log search (email domain). This Transform looks for stolen records where a login or username contains your domain as an email address.
- Select all or some returned Stealer Credential Entities and run Extract ALL Personally Identifiable Information Transform. You will get the specific stolen credentials and a stealer log.
Note on access
Please note that stealer logs are only accessible to Enterprise plan users. If you do not see the Transforms mentioned above in your Transform Menu, you might be on a different plan. In that case, jump to Step 3.
Please note that stealer logs are only accessible to Enterprise plan users. If you do not see the Transforms mentioned above in your Transform Menu, you might be on a different plan. In that case, jump to Step 3.
Stealer logs disclaimer
The search queries data that has already been stolen or breached and is already circulating in underground markets. Nothing is being accessed, compromised, or exfiltrated by running it.
The search queries data that has already been stolen or breached and is already circulating in underground markets. Nothing is being accessed, compromised, or exfiltrated by running it.
What you can find
Once the Transform runs, the graph will populate with the following:
- The employee's name, attached to the corporate email address in the record.
- The password captured alongside it — check whether it would still work, and whether its pattern suggests others in use.
- The originating IP address of the infected endpoint.
- The service the credentials were used against.
Step 2: Explore a specific endpoint
Step 1 told you what was stolen relating to the domain. This step asks a bigger question of one record: what else did that same infected device give up?
After you expand the stealer credentials, the graph will populate it with the stealer log Entity. Move the stealer log Entity to a new graph and run Extract ALL Personally Identifiable Information.
Graph will return everything harvested from that specific device that might include:
After you expand the stealer credentials, the graph will populate it with the stealer log Entity. Move the stealer log Entity to a new graph and run Extract ALL Personally Identifiable Information.
Graph will return everything harvested from that specific device that might include:
- social media handles
- personal email addresses
- physical addresses
- phone numbers
- browsing and search history
- financial or banking details.
Step 3: Look for breach data against the domain
An independent line of enquiry from the same starting point. Where Steps 1 and 2 went deep on individual compromised devices, this measures breadth — how widely the organization's addresses appear across leaked datasets.
How to:
What you can find
Leak records referencing the domain, typically surfacing a long list of exposed email addresses.
How to:
- Open the Transform menu by right-clicking on the Entity.
- Run Person of Interest → Comprehensive Search → [POI] D4 - Leaked Records Search (domain) or [Darkweb] Search Posts by Email Domain [DarkOwl]
- Once breach results appear, select the Compromised Records Entities on your graph. Right-click and run Extract all personally identifiable information to pull structured data out of those records.
What you can find
Leak records referencing the domain, typically surfacing a long list of exposed email addresses.
When to stop?
Exposure assessment has no natural end point — underground data keeps accumulating, and every infected endpoint can be followed further. What marks completion is having enough to support the decision the assessment exists to inform: what to remediate, or whether to proceed.
What's next?
-
Map the online presence of an alias identity.
-
Set up a Threat Actor monitor for tracking the person's social media feed for threatening posts.
-
Investigate the threat actor on Telegram
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
What is Maltego?
Write your awesome label here.