ServiceNow Security Alert: Defending Against False Positives and Anomalous Instance Activity

---
title: Potential ServiceNow SSRF to Cloud Metadata
id: 8a4b2c19-1d3e-4f5a-9b6c-8d7e0f1a2b3c
status: experimental
description: Detects outbound connection attempts from ServiceNow infrastructure IPs to the cloud instance metadata service (169.254.169.254). This is a high-fidelity indicator of SSRF exploitation.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://www.darkreading.com/vulnerabilities-threats/bug-bounty-research-triggers-servicenow-security-alert
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationIp|startswith: '169.254.169.254'
  filter_service_now:
    SourceIp|contains:
      - 'ServiceNow IP Range Placeholder' # Defenders should populate with specific SN egress IPs
  condition: selection and filter_service_now
falsepositives:
  - Legitimate cloud instance initialization (rare for user-triggered SN instances)
level: critical
---
title: ServiceNow Outbound to Private Address Space
id: 9c5d3e20-2e4f-5g6b-0c7d-9e8f1a2b3c4d
status: experimental
description: Detects ServiceNow instances initiating connections to RFC1918 private address spaces, indicative of internal network scanning or pivot attempts.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1071
logsource:
  category: network_connection
  product: proxy
detection:
  selection:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  filter_research:
    UserAgent|contains: 'security_research_tool' # Example UA seen in recent research
  condition: selection and not filter_research
falsepositives:
  - Authorized ServiceNow integrations with on-premise systems
level: high

// Hunt for ServiceNow instances connecting to Instance Metadata Service
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP has "169.254.169.254"
| where InitiatingProcessFileName has_any ("servicenow", "node", "java") // Adjust based on observed SN processes in logs
| project Timestamp, DeviceName, InitiatingProcessAccount, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for processes establishing connections to Link-Local metadata IP
-- This VQL targets the endpoint perspective, checking if any process is reaching out to metadata
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE CommandLine =~ '169.254.169.254'
   OR Name =~ 'curl'
   OR Name =~ 'wget'

// Complementary network check
SELECT RemoteAddr, RemotePort, State, Pid
FROM netstat()
WHERE RemoteAddr =~ '169.254.169.254'

<#
.SYNOPSIS
    Harden Windows Firewall against Instance Metadata Access (SSRF).
.DESCRIPTION
    This script creates a block rule for the link-local metadata IP
    (169.254.169.254) to prevent SSRF attacks from leaking cloud credentials.
#>

$MetadataIP = "169.254.169.254"
$RuleName = "Block Instance Metadata SSRF"

$ExistingRule = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue

if (-not $ExistingRule) {
    Write-Host "Creating firewall rule to block $MetadataIP..." -ForegroundColor Cyan
    New-NetFirewallRule -DisplayName $RuleName `
                        -Direction Outbound `
                        -Action Block `
                        -RemoteAddress $MetadataIP `
                        -Profile Any `
                        -Enabled True `
                        -Description "Block outbound connections to Instance Metadata Service to mitigate SSRF."
    Write-Host "Rule created successfully." -ForegroundColor Green
} else {
    Write-Host "Firewall rule '$RuleName' already exists." -ForegroundColor Yellow
}

# Optional: Audit recent outbound connections to this IP
Write-Host "Checking for recent connections in event logs..." -ForegroundColor Cyan
# Note: Requires appropriate logging enabled (e.g., Windows Firewall Advanced Logging)