ServiceNow Unauthenticated REST Resource Access via Guest Account or Known Attacker IP

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•4

Detects unauthorized access attempts to ServiceNow Scripted REST APIs, specifically targeting misconfigured endpoints that do not require authentication. This rule monitors for requests made by the 'guest' user, known malicious IP addresses, or requests missing authorization headers directed at potentially vulnerable APIs like 'related_list_edit'.