ServiceNow Scripted REST Resource Unauthenticated Access - Guest related_list_edit

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized, unauthenticated API activity targeting the ServiceNow 'related_list_edit' Scripted REST resource. The rule specifically alerts on requests originating from the 'Guest' account or where authentication requirements have been disabled, which are known indicators of exploitation.