Potential Credential Exposure in IIS Logs

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•1

This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.