WHEN IT SNOWS IT POURS – ANATOMY OF A SERVICENOW RED TEAM

Summary from the TLDR InfoSec newsletter

MDSec red-team engagements turned phished ServiceNow users, exposed MID config.xml files, and over-permissioned roles into tenant admin access. Roles including catalog_admin, import_admin, and sn_cmdb_editor enabled Glide-script execution or role chaining. Operators created hidden admin accounts, altered timestamps, removed login and role histories, and used scheduled jobs as SnowFall C2 callbacks. From the tenant, they enumerated incidents and attachments, extracted credentials, bypassed adaptive authentication, and executed commands on MID servers through JAR plugins or the ECC queue.