Application-EventID10.ps1

param([int]$RecordID)

# Created for: https://github.com/phbits/WebsiteFailedLogins/issues/2

# Sample Event Message Data #
<#
ClientIP = 127.0.0.1
FailedLogins = 20
Sitename = W3SVC1
IISLogPath = C:\inetpub\logs\LogFiles\W3SVC\*
Authentication = Basic
HttpResponse = 401
UrlPath = /login.aspx
Start = 2021-01-26 18:17:51
End ~ 2021-01-26 18:22:51
#>
$xmlQuery = @"
<QueryList>
 <Query Id="0" Path="Application">
  <Select Path="Application">*
   [System[(EventRecordID=$($RecordID))]]
  </Select>
 </Query>
</QueryList>
"@
 
$triggeredEvent = Get-WinEvent -FilterXml $xmlQuery

$clientIP = $triggeredEvent.Message.Split("`n") | ?{ $_.StartsWith('ClientIP = ') }
$sitename = $triggeredEvent.Message.Split("`n") | ?{ $_.StartsWith('Sitename = ') }
$urlPath  = $triggeredEvent.Message.Split("`n") | ?{ $_.StartsWith('UrlPath = ') }

$urlPath = $urlPath.Replace('UrlPath = ','')
$clientIP = $clientIP.Replace('ClientIP = ','')
$iisSiteId = $sitename.ToLower().Replace('sitename = w3svc','')
$iisSite = Get-IISSite | ?{ $_.ID -eq $iisSiteId }

# Microsoft is focused on IISAdministration module as opposed the older and no longer updated WebAdministration cmdlets.
# Found this out by submitting Request Filtering PowerShell snippets to Microsoft Docs
# https://blogs.iis.net/iisteam/introducing-iisadministration-in-the-powershell-gallery
Start-IISCommitDelay

$iisIpSecurity = Get-IISConfigSection -CommitPath "$($iisSite.Name)" -SectionPath 'system.webServer/security/ipSecurity' | Get-IISConfigCollection
New-IISConfigCollectionElement -ConfigCollection $iisIpSecurity -ConfigAttribute @{ 'ipAddress' = "$($clientIP.Trim())" }

Stop-IISCommitDelay

$body = @{
    'ip'         = $clientIp; 
    'categories' = 18; 
    'comment'    = "Automatic report - Vulnerability scan`n$($urlPath)"
}
$headers = @{
    'Accept' = 'application/json';
    'Key'    = 'Your Key Here' # Use key from https://www.abuseipdb.com/account/api
} 

$response = Invoke-RestMethod -Uri 'https://api.abuseipdb.com/api/v2/report' -Headers $headers -Body $body -Method POST

The categories parameter (line 50) should probably be 18 (Brute-Force) instead of 21 (Web App Attack), see categories for further details.