Suspicious Google Ad Service Redirects
This rule detects suspicious ad click traffic that routes through Google Ad Services It specifically looks for URLs containing Google Click Identifier (gclid), an ad URL, and a placement ID, while excluding legitimate ad routing services. This could indicate ad fraud or malvertising. Most but not all clicks on Google ads are routed this way.
Splunk (SPL)
