High Volume External Referrer Requests to IIS
Detects IP addresses generating a high volume of web requests to an IIS server where the referrer is external to the host. This can indicate web scraping, reconnaissance, or denial-of-service attempts.
Microsoft Sentinel (KQL)
