With all the recent publicity over SQL Injection attacks, it looks as if Microsoft has pushed through and released urlscan 3.0 RTW.

UrlScan 3 looks at building on the features of UrlScan 2.5, which is built into IIS. The main feature that interests me is the ability to blacklist words, so whereas the recent SQL injection attacks contained words such as DECLARE,CAST,EXEC. You can configure UrlScan to block the request and redirect to a 404 page. Here's a good example.

And here's an in-depth article from the team at IIS.