Plex2Shell Exploit Chain Hits Plex Media Server: Detection and Remediation Guide for Crypto Miner and Reverse Proxy Attacks

---
title: Plex Media Server Spawning Shell or Download Utility
id: 3f9a2c14-8b7d-4e51-a9c2-6d1e4f7a8b90
status: experimental
description: Detects Plex Media Server processes spawning shells, curl, or wget — a high-fidelity indicator of Plex2Shell exploit chain execution leading to miner or proxy payload staging.
references:
  - https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'Plex Media Server'
      - '/plexmediaserver'
      - 'PlexMediaServer'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Plex plugins or third-party agents invoking scripts (rare; validate against baseline)
level: critical
---
title: Crypto Miner or Reverse Proxy Staging in Temporary Directories
id: 7b1e5d28-4c6f-4a93-b2d8-9e3a1f5c6d72
status: experimental
description: Detects execution of binaries from world-writable temporary paths combined with miner-typical command-line arguments, consistent with Plex2Shell post-exploitation payload staging.
references:
  - https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.impact
  - attack.t1496
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  selection_args:
    CommandLine|contains:
      - 'xmrig'
      - 'stratum+tcp'
      - 'stratum+ssl'
      - '--coin'
      - 'minexmr'
      - 'supportxmr'
      - 'pool.'
      - '--donate-level'
  condition: selection_path or selection_args
falsepositives:
  - Legitimate development tools in /tmp (uncommon in production servers)
level: high
---
title: Persistence via Cron or Systemd by Plex Service Account
id: 2c4d8e61-5f3a-4b78-c1e9-8a2d6f4b7e35
status: experimental
description: Detects the plex service account writing cron entries or systemd units, a persistence technique observed in post-exploitation of media server compromises.
references:
  - https://attack.mitre.org/techniques/T1053/003/
  - https://attack.mitre.org/techniques/T1543/002/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1543.002
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/etc/cron.d/'
      - '/var/spool/cron/'
      - '/etc/systemd/system/'
      - '/usr/lib/systemd/system/'
    User|contains: 'plex'
  condition: selection
falsepositives:
  - Plex package updates writing service units (correlate with update events)
level: high

// Hunt 1: Plex Media Server spawning shells or download utilities (Linux via Syslog/MDE, Windows via DeviceProcessEvents)
let suspiciousChildren = dynamic(["sh", "bash", "dash", "curl", "wget", "python", "python3", "nc", "ncat", "powershell.exe", "cmd.exe"]);
union isfuzzy=true
(DeviceProcessEvents
 | where InitiatingProcessFileName has_any ("Plex Media Server", "PlexMediaServer", "plexmediaserver")
 | where FileName has_any (suspiciousChildren)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName),
(Syslog
 | where Facility == "auth" or SyslogMessage has "plex"
 | where SyslogMessage has_any (suspiciousChildren) and SyslogMessage has_any ("/tmp", "curl", "wget", "bash -i", "/dev/tcp")
 | project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by TimeGenerated desc;

// Hunt 2: Outbound connections FROM Plex process to non-Plex infrastructure (miner pools / reverse proxies)
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("Plex Media Server", "PlexMediaServer", "plexmediaserver")
| where RemoteIPType == "Public"
| where not(RemoteUrl has_any ("plex.tv", "plex.direct", "amazonaws.com", "cloudfront.net"))
| where RemotePort in (3333, 4444, 5555, 7777, 14444, 45700) or RemoteUrl has_any ("pool", "stratum")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, RemotePort
| order by ConnectionCount desc;

-- Plex2Shell post-exploitation hunt: suspicious children of Plex, tmp-resident binaries, and miner/proxy connections
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (CommandLine =~ 'xmrig|stratum|minexmr|supportxmr|--donate-level'
   OR Exe =~ '^/(tmp|var/tmp|dev/shm)/'
   OR (Username =~ 'plex' AND Name =~ '^(sh|bash|dash|curl|wget|nc|ncat|python3?)$'))

-- Corroborate with network state: established outbound connections from Plex or tmp-resident processes
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND RemotePort in (3333, 4444, 5555, 7777, 14444, 45700)

#!/usr/bin/env bash
# Plex2Shell triage & hardening script — run as root. Triage first, contain second.
set -u
OUT="/tmp/plex_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"

echo "[*] Collecting volatile evidence to $OUT"
ps auxww > "$OUT/ps_aux.txt"
ss -tunap > "$OUT/netstat.txt" 2>/dev/null || netstat -tunap > "$OUT/netstat.txt"

# 1. Suspicious processes: miners, tmp-resident binaries, Plex children
echo "[*] Checking for miner / tmp-resident / Plex-spawned processes"
ps auxww | grep -Ei 'xmrig|stratum|minexmr|supportxmr|kdevtmpfsi|kinsing' | grep -v grep > "$OUT/miner_procs.txt"
ls -la /tmp /var/tmp /dev/shm > "$OUT/tmp_dirs.txt" 2>/dev/null
find /tmp /var/tmp /dev/shm -type f -executable -mtime -30 -exec ls -la {} \; > "$OUT/tmp_executables.txt" 2>/dev/null

# 2. Persistence audit: cron, systemd, Plex account artifacts
echo "[*] Auditing persistence mechanisms"
crontab -l -u plex > "$OUT/plex_crontab.txt" 2>/dev/null
ls -la /etc/cron.d /var/spool/cron /etc/systemd/system > "$OUT/persistence_dirs.txt" 2>/dev/null
grep -rEl 'curl|wget|base64|/tmp/' /etc/cron.d /var/spool/cron 2>/dev/null > "$OUT/suspicious_cron.txt"
systemctl list-units --type=service --all | grep -viE 'plex|systemd|cron|ssh|network|dbus|getty|journal|udev|login|user@' > "$OUT/unusual_services.txt"

# 3. Web access log review for exploit probes against port 32400
echo "[*] Reviewing recent access to Plex web service"
PLEXLOGDIR="/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Logs"
[ -d "$PLEXLOGDIR" ] && cp -n "$PLEXLOGDIR"/*.log "$OUT/" 2>/dev/null

# 4. Version check — flag anything not current
echo "[*] Installed Plex version:"
if command -v dpkg >/dev/null; then dpkg -l | grep -i plex; fi
if command -v rpm  >/dev/null; then rpm -qa | grep -i plex; fi

echo ""
echo "================= ACTION ITEMS ================="
echo "[1] UPDATE Plex immediately: https://www.plex.tv/media-server-downloads/"
echo "[2] DISABLE Remote Access until patched: Settings -> Remote Access -> Disabled"
echo "[3] REMOVE port forwarding for TCP/32400 at the perimeter/firewall"
echo "[4] If artifacts found above: isolate host, preserve $OUT, rebuild from known-good"
echo "[5] ROTATE Plex account token and any credentials stored on the host"
echo "[6] Block outbound stratum/mining ports at egress (3333,4444,5555,7777,14444)"

echo ""
echo "[*] Triage bundle complete: $OUT — review before remediation"