All requests would show up in the iis logs.

Depending on the volume of requests that your site normally receives, your first clue might be an unusually large log file. 

POET makes a significant number of requests to your app as part of the exploit.