I installed an application server firewall on my IIS 6 box...  I get a few url query string attacks per day, however, they are blocked and logged.  What exactly is the person trying to accomplish with the below url query string attack?

Type: predefined rules: ;

http method: GET

url: /ScriptResource.axd

url query string: d=cenhN4ktOA1l4wDDifyrsqd7xbDUCr5pmcTM1-AVDNlz30093Un6-Yf6K-

I beleive complete syntax would look like this: /ScriptResource.axd;d=cenhN4ktOA1l4wDDifyrsqd7xbDUCr5pmcTM1-AVDNlz30093Un6-Yf6K-

Why is it that only certain connections only do this?  From my IP address I access every single aspect of the website a TON of times and I've never seen this show up before... 

Also,

They used the ';' character.  Is that used in this type of request?

the ; is not a valid character in a querystring hence your IDS blocking it. The ajax queries will use a ? for parameters ie scriptresource.axd?d= . I'm not sure why you're seeing an invalid request, perhaps a poorly written 3rd party module?

Cathal