ServiceNow Unauthenticated REST API Data Exfiltration via Scripted Endpoint Abuse

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects unauthenticated requests directed at ServiceNow Scripted REST Resource endpoints, specifically targeting path segments like '/api/now/related_list_edit/create' or general '/api/now/' paths. The rule looks for transaction activity identified as 'Guest' user or lacking necessary authorization headers, potentially indicating exploitation of ServiceNow platform vulnerabilities.