Defending Against 'Clean' Residential Proxy Carding: Identity Evasion Detection

---
title: Potential Anti-Detect Browser Execution
id: 9a8f7c21-6e5d-4b3a-9c1d-2e4f6a8b0c1d
status: experimental
description: Detects the execution of known anti-detect browsers often used to manage browser fingerprints for carding and fraud operations.
references:
  - https://www.bleepingcomputer.com/news/security/inside-the-search-for-clean-residential-proxies-for-carding/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\incogniton.exe'
      - '\kameleo.exe'
      - '\multilogin.exe'
      - '\linken sphere.exe'
      - '\ghostbrowser.exe'
  condition: selection
falsepositives:
  - Authorized fraud testing or QA activities
level: high
---
title: Suspicious Proxy Service Listening Ports
id: 4d3e2c10-9b8a-4f7d-6e5c-1a2b3c4d5e6f
status: experimental
description: Detects processes listening on common proxy ports which may indicate the endpoint is part of a residential proxy botnet.
references:
  - https://www.bleepingcomputer.com/news/security/inside-the-search-for-clean-residential-proxies-for-carding/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 8080
      - 3128
      - 1080
      - 9050
    Initiated: 'false'
  filter:
    Image|contains:
      - '\Program Files\'
      - '\System32\'
  condition: selection and not filter
falsepositives:
  - Legitimate web server or proxy software
level: medium

let TimeRange = 1h;
let FailedTransactions = materialize (
    DeviceNetworkEvents
    | where Timestamp > ago(TimeRange)
    | where ActionType in ("ConnectionFailed", "PaymentDeclined", "AuthFailure") // Customize based on your logs
    | project Timestamp, SrcIpAddr, DeviceName, UserAgent, AdditionalFields
);
let IpCount = FailedTransactions
| summarize count() by SrcIpAddr, UserAgent
| summarize IpCount = dcount(SrcIpAddr) by UserAgent
| where IpCount > 10 // Threshold: Same User-Agent from > 10 distinct IPs
;
FailedTransactions
| join kind=inner (IpCount) on UserAgent
| project Timestamp, SrcIpAddr, UserAgent, DeviceName
| sort by Timestamp desc

-- Hunt for Anti-Detect Browser Artifacts
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='*/AppData/Local/Incogniton/*')
WHERE NOT FullName =~ '%recycle%'

UNION ALL

SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='*/AppData/Local/Kameleo/*')
WHERE NOT FullName =~ '%recycle%'

UNION ALL

-- Hunt for suspicious proxy configuration files
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Windows/System32/drivers/etc/hosts')
WHERE 
   -- Read content and check for known proxy redirections or suspicious entries
   read_file(filename=FullPath) =~ 'proxy' OR read_file(filename=FullPath) =~ 'tor'

# Check for common Anti-Detect Browser Installations
$PathsToCheck = @(
    "$env:LOCALAPPDATA\Incogniton",
    "$env:LOCALAPPDATA\Kameleo",
    "$env:LOCALAPPDATA\Multilogin",
    "${env:ProgramFiles(x86)}\Linken Sphere"
)

foreach ($Path in $PathsToCheck) {
    if (Test-Path $Path) {
        Write-Warning "Suspicious anti-detect software found at: $Path"
        # Optional: Remove-Item -Path $Path -Recurse -Force
    }
}

# Check for Proxy Settings Changes via Registry
$ProxyPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
$ProxyEnable = Get-ItemProperty -Path $ProxyPath -Name "ProxyEnable" -ErrorAction SilentlyContinue

if ($ProxyEnable.ProxyEnable -eq 1) {
    $ProxyServer = Get-ItemProperty -Path $ProxyPath -Name "ProxyServer" -ErrorAction SilentlyContinue
    Write-Warning "Proxy is enabled on this machine: $($ProxyServer.ProxyServer)"
    # Investigate if this is authorized corporate proxy or a residential proxy client
}