Potential Inbound Web Traffic Accepted by IIS Processes on Endpoints
This query identifies devices that have accepted inbound web traffic (ports 80/443) where the accepting process is IIS worker (w3wp.exe) or IIS Express (iisexpress.exe). It focuses on public IPv4 sources (excluding RFC1918/private, loopback, and IPv6), helping you surface internet-exposed web servers that are actively receiving external connections.
Microsoft Sentinel (KQL)
