Potential IIS code injection attempt
'Potential code injection into web server roles via IIS logs scan. Represents attempt to gain initial access using drive-by compromise technique. Detection flags events for review and filtering of authorized activity.'
Microsoft Sentinel (KQL)
