IIS Web Server Brute Force or Enumeration Attempt

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•1

This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.