High-Frequency External IP Requests to ServiceNow REST API Endpoints

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.