Auditing IIS Security with Log Parser

Identifying Unusual HTTP Requests
You can often find evidence of attacks on a Web site by looking for unusual verbs in HTTP requests. In general, most legitimate HTTP requests include either POST or GET. The following script will output any verb that exists within the WC3 Extended log file format that isn't POST or GET, as well as the request retrieved from the Web server, the status code of the request, and the requesting client's IP address.

---UNUSUALVERBS.SQL---
SELECT c-ip, cs-method, 
  cs-uri-stem, sc-status, 
  sc-substatus, COUNT(*) 
FROM <1> 
WHERE (cs-method NOT IN 
  ('POST';'GET')) 
GROUP BY c-ip, cs-method, 
  cs-uri-stem, sc-status, 
  sc-substatus 
ORDER BY COUNT(*) DESC   
---UNUSUALVERBS.SQL---

Unusual verbs can be innocuous, but they can also be an anomaly that requires further investigation. Multiple instances of the same verb from many IP addresses are more likely to be innocuous than are multiple instances of a verb from the same IP address. Multiple verbs from the same IP address that no other Web site visitors have used are a red flag that you shouldn't ignore. . . .