Gambling Affiliate Tracking Parameters (Borrowed Trust)
This rule identifies HTTP requests containing specific URL affiliate tracking parameters associated with the "Borrowed Trust" SEO poisoning campaign. The campaign utilizes these parameters to monetize its activities, often redirecting users to gambling sites. Detection is based on the presence of known affiliate codes in `RemoteUrl` from `DeviceNetworkEvents` or `RequestURL` from `CommonSecurityLog` (proxy/firewall logs).
Microsoft Sentinel (KQL)
