ServiceNow Unauthenticated REST API Exploit - Attacker IP 51.159.98.241

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potential exploitation attempts against ServiceNow instances by monitoring network and DNS activity involving a known malicious IP address (51.159.98.241). It identifies high-volume connections or DNS requests related to service-now.com associated with this IP, which may indicate an attacker attempting to leverage unauthenticated Scripted REST resources.