ServiceNow Unauthenticated Scripted REST API Enumeration - T1190/T1210

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects anomalous, unauthenticated access to API endpoints commonly associated with table enumeration, often targeting ServiceNow interfaces or similar REST APIs. The rule monitors for a high volume of unique API paths or tables requested by a single IP address without an authorization token present, as well as tracking access from known malicious IP addresses.