Ok, found something here: http://tusksoft.com/blog/posts/6/clean-up-your-google-analytics-and-help-stop-referer-spam-with-this-simple-rewrite-rule:
This seems to work:
<rewrite>
<rules>
<rule name="abort referer spam requests" stopProcessing="true">
<match url=".*" />
<conditions>
<add input="{HTTP_REFERER}" pattern="(semalt\.com)|(buttons\-for\-website\.com)" />
</conditions>
<action type="AbortRequest" />
</rule>
<!--The rest of your rules, if you have any-->
</rules>
</rewrite>