IIS Permissions that will result in no hacks

I have numerous WP websites and they are getting hacked on IIS like putting butter on bread. What are the permissions to set on the files. When I look at this thread __> https://www.ads-software.com/support/topic/file-permissions-for-wordpress-on-iis-80/

This looks like the most unsecure set of permissions. Why does the IISAppPool account and all USERS need full control ? That’s insane. No wonder they are hacking it.

Does anyone have a thread that lists the least privileges for WP to work on IIS?