ServiceNow Unauthenticated Scripted REST API Exploitation - 4xx to 200 Bypass
Detects potential exploitation of unauthenticated ServiceNow Scripted REST Resources by identifying a pattern where external IP addresses first receive 4xx (authentication required) responses when querying /api/ paths, followed by 200 OK responses for the same paths, indicating a successful authentication bypass.
YARA-L
