IIS

Report scanners from IIS W3C logs with PowerShell.

Scanners ask IIS for files that only exist on other platforms: .env, .git/config, wp-login.php. That makes them easy to spot in the W3C log. This PowerShell script reports today's offenders; run it hourly from Task Scheduler.

Report scanners

$key  = $env:ISIPSAFE_KEY
$log  = "C:\inetpub\logs\LogFiles\W3SVC1\u_ex{0}.log" -f (Get-Date).ToUniversalTime().ToString("yyMMdd")
$lines = Get-Content $log
# Find the c-ip column from the #Fields header rather than assuming its position.
$fields = (($lines | Where-Object { $_ -like "#Fields:*" } | Select-Object -Last 1) -replace "^#Fields: ", "") -split " "
$ipCol  = [Array]::IndexOf($fields, "c-ip")
$uriCol = [Array]::IndexOf($fields, "cs-uri-stem")
$hits = foreach ($l in $lines) {
  if ($l -like "#*") { continue }
  $f = $l -split " "
  if ($f[$uriCol] -match '/(\.env|\.git/|wp-login\.php|xmlrpc\.php|phpmyadmin|vendor/phpunit|cgi-bin/)') { $f[$ipCol] }
}
$hits | Sort-Object -Unique | ForEach-Object {
  try {
    Invoke-RestMethod -Method Post -Uri "https://isipsafe.com/api/v1/report" -Headers @{ Authorization = "Bearer $key" } `
      -Body @{ ip = $_; categories = "web-app-attack,vuln-scan"; comment = "IIS: probing for .env, .git, wp-login or phpMyAdmin" } | Out-Null
  } catch { }   # 429 means already reported in the last 15 minutes
}

The path assumes site ID 1 and UTC log file names, the IIS default; adjust W3SVC1 for other sites. Remove any path your application really serves.

Behind a load balancer or Cloudflare, c-ip is the proxy. Log the client address (the X-Forwarded-For custom field in IIS logging) and read that column instead, or you will report your own proxy.

Block listed addresses

Use Windows Firewall rather than IIS IP restrictions: thousands of entries in applicationHost.config slow down every configuration change, while the firewall handles them in the kernel.

Need a hand?

If something here does not work with your version of IIS, or you have improved it, tell us. We update these pages with what people send.

IIS and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.