<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-corporate-entity-research
description: >-
  Map corporate structures, identify beneficial ownership, trace shell company
  networks, and uncover nominee directors using public registries, filings, and
  cross-jurisdictional data. Bellingcat corporate investigation methodology.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - corporate-research
  - beneficial-ownership
  - shell-companies
  - opencorporates
  - osint
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1591"]
---

# Performing Corporate Entity Research

## Overview

Corporate entity research maps ownership structures to identify the real people
behind companies. Combines data from company registries across jurisdictions to
trace beneficial ownership through layers of shell companies and nominees.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| NetworkX | `pip install networkx` |
| requests | `pip install requests` |

## Key Concepts

### Ownership Structure Types

| Structure | Description |
|---|---|
| **Direct ownership** | Individual directly owns shares |
| **Layered holding** | Company A owns B which owns target |
| **Circular ownership** | A→B→C→A creates audit-proof loop |
| **Trust structure** | Beneficial owner hidden behind trust |
| **Nominee arrangement** | Professional nominee acts as front |

### Key Registries

| Registry | Jurisdiction | URL |
|---|---|---|
| OpenCorporates | Global | `api.opencorporates.com` |
| Companies House | UK | `beta.companieshouse.gov.uk` |
| SEC EDGAR | US | `www.sec.gov/edgar` |
| Handelsregister | Germany | `www.handelsregister.de` |
| BOSA | Belgium | `kbopub.economie.fgov.be` |

## Quick Reference

```bash
# Deep company profile
node agent.js company-profile --jurisdiction gb --number 12345678

# Find all directorships for an officer
node agent.js officer-network --name "Jane Smith" --jurisdiction gb

# Build ownership graph
node agent.js ownership-graph --company-id gb/12345678 --depth 3 --output graph.gexf

# Detect nominee patterns
node agent.js nominee-detect --officer-name "Corporate Services Ltd"
```

## Workflow

```
1. SEED       — Start with known entity or individual
2. PROFILE    — Pull full company record from registry
3. OFFICERS   — List all directors, secretaries, shareholders
4. CROSS-REF  — Check each officer's other directorships
5. GRAPH      — Build ownership and relationship graph
6. PATTERN    — Identify nominee, shell, and circular patterns
7. VERIFY     — Confirm findings via independent sources
8. REPORT     — Document corporate structure with evidence
```

## Detection

```yaml
title: Corporate Entity Research Detection
id: 846c7e16-c325-48b6-8f43-225d02561eb3
status: experimental
description: Detects suspicious activity related to performing corporate entity research techniques in investigation attribution context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1591
  - attack.command_and_control
falsepositives:
  - Threat intelligence enrichment services querying external APIs
```

## Verification

```bash
python3 -c "import networkx; print('NetworkX OK')"
node agent.js --self-test
```

## References

- [OpenCorporates API Documentation](https://api.opencorporates.com/)
- [Companies House Developer API](https://developer.company-information.service.gov.uk/)
- [Bellingcat Corporate Research Guide](https://www.bellingcat.com/resources/)
- [ICIJ Offshore Leaks](https://offshoreleaks.icij.org/)
