ServiceNow REST API Mass Enumeration via Unauthenticated Guest Session

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule monitors ServiceNow API traffic for high-volume requests originating from unauthenticated or guest accounts, particularly outside of standard business hours. It uses time-windowed aggregation to detect potential brute force, unauthorized scanning, or enumeration attempts against the ServiceNow platform.