Plex2Shell: Plex Media Server Exploit Chain

// HUNT: Plex service process spawns a shell, interpreter or downloader
// MITRE: T1190, T1059.004, T1105
// CONF: high  FP: medium  COST: low
// REQUIRES: Process creation with command line on a sensored Plex host (Linux, Windows or macOS). Parent names are truncated to 15 characters on some Linux sensors, so the pattern is prefix-anchored.
// FALSE POSITIVES: user-configured DVR post-processing or media scripts launched by Plex; wrapper shells in some container images
// TUNING: after a 30 day baseline, exclude approved script names with | CommandLine!=/approved_script_name/i. Never exclude Plex Transcoder as the parent.
// LOOKBACK: 14d (exploitation began 2026-10-17)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(plex (media serv|transcoder|script hos|tuner serv|commercial)|plexmediaserver)/i
| FileName=/^(sh|bash|dash|zsh|ash|ksh|busybox|cmd|powershell|pwsh|wscript|cscript|mshta|python[0-9.]*|perl|curl|wget|nc|ncat|socat|script|setsid|nohup)(\.exe)?$/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName, SHA256HashData])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, endpoint.name, src.process.name, tgt.process.name

// HUNT: Plex service process spawns a shell, interpreter or downloader
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1105
// CONF: high | FP: medium
// FALSE POSITIVES: user-configured DVR post-processing or media scripts launched by Plex; wrapper shells in some container images
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Plex service process is the creator of a shell, interpreter or downloader image. On a Process Creation event the creator is src.process.* and the new process is tgt.process.*. Matching is case-insensitive and the Plex name is prefix-anchored, which reproduces the CQL /i intent and the 15 character truncation allowance.
// REQUIRES: SentinelOne agent process-creation telemetry on the Plex host (Linux, Windows or macOS)
// TUNING: After a 30 day baseline exclude approved DVR post-processing scripts by tgt.process.cmdline. Never exclude Plex Transcoder as the creating process.
// LOOKBACK: 14d (set in the time picker; exploitation began 2026-10-17)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the agent did not observe starting is not captured. The SHA256 of the new image is not projected here; the hash pivot is the separate hash card.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(plex (media serv|transcoder|script hos|tuner serv|commercial)|plexmediaserver)' tgt.process.name matches '^(sh|bash|dash|zsh|ash|ksh|busybox|cmd|powershell|pwsh|wscript|cscript|mshta|python[0-9.]*|perl|curl|wget|nc|ncat|socat|script|setsid|nohup)(\\.exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: Plex service process spawns a shell, interpreter or downloader
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004, T1105
// CONF: high | FP: medium
// FALSE POSITIVES: user-configured DVR post-processing or media scripts launched by Plex; wrapper shells in some container images
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on process creation: the initiating process is a Plex service image and the created process is a shell, interpreter or downloader. contains-style matching is done with a case-insensitive regex, which reproduces the CQL /i intent and keeps the Plex name prefix-anchored.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on the Plex host
// TUNING: After a 30 day baseline exclude approved DVR post-processing scripts by ProcessCommandLine. Never exclude Plex Transcoder as the initiating process.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName matches regex @"(?i)^(plex (media serv|transcoder|script hos|tuner serv|commercial)|plexmediaserver)"
| where FileName matches regex @"(?i)^(sh|bash|dash|zsh|ash|ksh|busybox|cmd|powershell|pwsh|wscript|cscript|mshta|python[0-9.]*|perl|curl|wget|nc|ncat|socat|script|setsid|nohup)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA1
| sort by Timestamp desc
| take 200

// HUNT: Process started by a shell that Plex launched
// MITRE: T1059.004, T1105, T1496
// CONF: medium  FP: medium  COST: low
// REQUIRES: Process creation with parent and grandparent lineage (validate GrandparentBaseFileName is populated by your Linux sensor version)
// FALSE POSITIVES: approved DVR post-processing chains; container entrypoint wrappers
// TUNING: exclude approved chains with | FileName!=/^(ffmpeg|comskip|mediainfo)$/i after baselining
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| GrandparentBaseFileName=/^(plex (media serv|transcoder|script hos|tuner serv|commercial)|plexmediaserver)/i
| ParentBaseFileName=/^(sh|bash|dash|zsh|ash|busybox|cmd|powershell|pwsh|python[0-9.]*|perl)(\.exe)?$/i
| table([@timestamp, ComputerName, aid, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, ImageFileName, SHA256HashData])

event.type = 'Process Creation' src.process.parent.name = *
| limit 5
| columns event.time, endpoint.name, src.process.parent.name, src.process.name

// HUNT: Process started by a shell that Plex launched
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1105, T1496
// CONF: medium | FP: medium
// FALSE POSITIVES: approved DVR post-processing chains; container entrypoint wrappers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lineage: a Plex process is the grandparent and a shell or interpreter is the parent of the new process. On a Process Creation event src.process.* is the creator of the new process (the shell) and src.process.parent.* is that creator's own parent (the Plex process), so the grandparent of the new process.
// REQUIRES: SentinelOne agent process-creation telemetry with creator-parent lineage
// TUNING: Exclude approved chains by tgt.process.name (for example ffmpeg, comskip, mediainfo) after baselining.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Chains where the shell was started by a process the agent did not observe are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.parent.name matches '^(plex (media serv|transcoder|script hos|tuner serv|commercial)|plexmediaserver)' src.process.name matches '^(sh|bash|dash|zsh|ash|busybox|cmd|powershell|pwsh|python[0-9.]*|perl)(\\.exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.parent.name, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessParentFileName, InitiatingProcessFileName, FileName
| take 5

// HUNT: Process started by a shell that Plex launched
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1105, T1496
// CONF: medium | FP: medium
// FALSE POSITIVES: approved DVR post-processing chains; container entrypoint wrappers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lineage: InitiatingProcessParentFileName is the grandparent of the created process and InitiatingProcessFileName is its parent shell. Matching is a case-insensitive regex with the Plex name prefix-anchored.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with parent lineage populated
// TUNING: Exclude approved chains by FileName (for example ffmpeg, comskip, mediainfo) after baselining.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Chains where the parent shell was not observed starting are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessParentFileName matches regex @"(?i)^(plex (media serv|transcoder|script hos|tuner serv|commercial)|plexmediaserver)"
| where InitiatingProcessFileName matches regex @"(?i)^(sh|bash|dash|zsh|ash|busybox|cmd|powershell|pwsh|python[0-9.]*|perl)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessParentFileName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA1
| sort by Timestamp desc
| take 200

// HUNT: Reverse-shell and PTY-upgrade command-line shapes
// MITRE: T1059.004, T1071
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Process creation with command line on Linux or macOS
// FALSE POSITIVES: administrators using /dev/tcp for port checks; monitoring scripts
// TUNING: exclude known monitoring hosts with | ComputerName!=/^monitor-/i and review hits whose user is the Plex service account first
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (CommandLine="*/dev/tcp/*" or CommandLine="*/dev/udp/*" or CommandLine=/script +-qc +\S+sh/i)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.name, tgt.process.cmdline

// HUNT: Reverse-shell and PTY-upgrade command-line shapes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1071
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators using /dev/tcp for port checks; monitoring scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same command-line predicate on process creation: a /dev/tcp or /dev/udp redirect, or a script -qc invocation of a shell used for PTY upgrade. contains and matches are case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne agent process-creation telemetry with command line on Linux or macOS
// TUNING: Exclude known monitoring hosts by endpoint.name and review hits whose creating account is the Plex service account first.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A reverse shell built without these command-line shapes is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline contains '/dev/tcp/' or tgt.process.cmdline contains '/dev/udp/' or tgt.process.cmdline matches 'script +-qc +\\S+sh')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Reverse-shell and PTY-upgrade command-line shapes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1071
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators using /dev/tcp for port checks; monitoring scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same command-line predicate on process creation: a /dev/tcp or /dev/udp redirect, or a script -qc invocation of a shell. The regex is case-insensitive through the (?i) prefix.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or macOS
// TUNING: Exclude known monitoring hosts by DeviceName and review hits whose account is the Plex service account first.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A reverse shell built without these command-line shapes is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where ProcessCommandLine contains "/dev/tcp/" or ProcessCommandLine contains "/dev/udp/" or ProcessCommandLine matches regex @"(?i)script +-qc +\S+sh"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Named Plex2Shell payloads and miner or proxy arguments
// MITRE: T1496, T1090, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: Process creation with command line (any platform)
// FALSE POSITIVES: sanctioned mining or proxy tooling in a lab
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (FileName=/^(myawesomeproxy|mylovelyminer|x12345)(\.exe)?$/i or CommandLine=/(proxystream\.st|stratum\+(tcp|ssl)|--donate-level|--rig-id)/i)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Named Plex2Shell payloads and miner or proxy arguments
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1496, T1090, T1105
// CONF: high | FP: low
// FALSE POSITIVES: sanctioned mining or proxy tooling in a lab
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process named like one of the published payloads, or a command line carrying a proxystream.st host, a stratum URL or a miner donate or rig flag. Matching is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne agent process-creation telemetry with command line (any platform)
// TUNING: Exclude sanctioned mining or proxy tooling in a lab by endpoint.name.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed payload run with none of these arguments is not captured; the hash card covers published samples.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.name matches '^(myawesomeproxy|mylovelyminer|x12345)(\\.exe)?$' or tgt.process.cmdline matches '(proxystream\\.st|stratum\\+(tcp|ssl)|--donate-level|--rig-id)')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Named Plex2Shell payloads and miner or proxy arguments
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1496, T1090, T1105
// CONF: high | FP: low
// FALSE POSITIVES: sanctioned mining or proxy tooling in a lab
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process named like one of the published payloads, or a command line carrying a proxystream.st host, a stratum URL or a miner donate or rig flag. The regex is case-insensitive through the (?i) prefix.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude sanctioned mining or proxy tooling in a lab by DeviceName.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed payload run with none of these arguments is not captured; the hash card covers published samples.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName matches regex @"(?i)^(myawesomeproxy|mylovelyminer|x12345)(\.exe)?$" or ProcessCommandLine matches regex @"(?i)(proxystream\.st|stratum\+(tcp|ssl)|--donate-level|--rig-id)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1
| sort by Timestamp desc
| take 200

// HUNT: Published Plex2Shell sample hashes executed
// MITRE: T1496, T1090, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: Process creation with file hash (any platform)
// FALSE POSITIVES: none expected; hashes are single-sourced so ship as detect only
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| in(SHA256HashData, values=[
  "5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441",
  "68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7",
  "b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49",
  "e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9",
  "2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db"
])
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, endpoint.name, tgt.process.image.sha256

// HUNT: Published Plex2Shell sample hashes executed
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1496, T1090, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected; hashes are single-sourced so ship as detect only
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the new process image carries one of the five published SHA-256 values. The in operator is case-sensitive and the published values are lowercase.
// REQUIRES: SentinelOne agent process-creation telemetry with image SHA-256 populated
// TUNING: Hashes are single-sourced, so treat a hit as a detect lead and confirm with the process lineage cards.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A rebuilt or repacked payload with a different hash is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.sha256 in ('5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441', '68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7', 'b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49', 'e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9', '2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path, tgt.process.image.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA256
| take 5

// HUNT: Published Plex2Shell sample hashes executed
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1496, T1090, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected; hashes are single-sourced so ship as detect only
// EQUIVALENCE: telemetry-gap - Partial pivot: the published values are SHA-256 only, and Microsoft documents SHA256 as usually unpopulated in DeviceProcessEvents. The query is correct where the column is populated and silent where it is not, so a clean result proves little.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with SHA256 populated
// TUNING: Check SHA256 population before trusting an empty result, and pivot on the CQL or PowerQuery tab where the hash is attested.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: SHA256 is usually unpopulated in DeviceProcessEvents; the source has no SHA1 or MD5 values to pivot on instead.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where SHA256 in~ ("5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441", "68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7", "b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49", "e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9", "2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Contact with published attacker addresses or proxystream.st
// MITRE: T1105, T1090, T1496
// CONF: high  FP: low  COST: low
// REQUIRES: Outbound network connection with process and DNS lookup (any platform)
// FALSE POSITIVES: address reuse by unrelated tenants after the campaign ends
// LOOKBACK: 30d
#event_simpleName=/^(NetworkConnectIP4|DnsRequest)$/
| (RemoteAddressIP4=/^(45\.194\.92\.222|91\.92\.40\.202|176\.65\.139\.228|217\.60\.194\.116)$/ or DomainName=/(^|\.)proxystream\.st$/i)
| table([@timestamp, ComputerName, aid, ContextBaseFileName, RemoteAddressIP4, RemotePort, DomainName, ContextProcessId])

event.type in ('DNS Resolved', 'IP Connect') event.dns.request = *
| limit 5
| columns event.time, event.type, dst.ip.address, event.dns.request

// HUNT: Contact with published attacker addresses or proxystream.st
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1090, T1496
// CONF: high | FP: low
// FALSE POSITIVES: address reuse by unrelated tenants after the campaign ends
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator set: an outbound connection to one of four published addresses, or a DNS lookup of proxystream.st or a subdomain. The DNS name is read from event.dns.request; the vendor field docs name dns.request, so the readiness test prints both.
// REQUIRES: SentinelOne agent network (IP Connect) and DNS (DNS Resolved) telemetry
// TUNING: Review address reuse by unrelated tenants before acting once the campaign ends.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DNS lookup answered from a resolver cache the agent did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type in ('DNS Resolved', 'IP Connect') (event.dns.request in:anycase ('proxystream.st') or event.dns.request matches '\\.proxystream\\.st$' or dst.ip.address in ('45.194.92.222', '91.92.40.202', '176.65.139.228', '217.60.194.116'))
| columns event.time, endpoint.name, event.type, src.process.name, dst.ip.address, dst.port.number, event.dns.request
| sort -event.time
| limit 1000

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemoteUrl
| take 5

// HUNT: Contact with published attacker addresses or proxystream.st
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1090, T1496
// CONF: high | FP: low
// FALSE POSITIVES: address reuse by unrelated tenants after the campaign ends
// EQUIVALENCE: approximate-analytic - DeviceNetworkEvents carries the published addresses and the destination host name when the connection had one, but it is not a DNS log: a lookup that was never followed by a connection is invisible. The hunt therefore covers connections to the four addresses and to proxystream.st by name, not every lookup.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Review address reuse by unrelated tenants before acting once the campaign ends.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers the same 30d window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DNS lookup with no following connection is not captured; DeviceNetworkEvents is not a DNS log.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("45.194.92.222", "91.92.40.202", "176.65.139.228", "217.60.194.116") or RemoteUrl =~ "proxystream.st" or RemoteUrl endswith ".proxystream.st"
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| sort by Timestamp desc
| take 1000

// HUNT: Loopback-prefixed wildcard DNS lookup (admin token theft step)
// MITRE: T1528, T1190
// CONF: high  FP: low  COST: low
// REQUIRES: DNS lookup telemetry on the Plex host (Linux DnsRequest coverage varies by sensor version)
// FALSE POSITIVES: developers testing local wildcard-DNS setups
// LOOKBACK: 14d
#event_simpleName=DnsRequest
| DomainName=/^127\.0\.0\.1\..+\.(sslip|nip)\.io$/i
| table([@timestamp, ComputerName, aid, DomainName, ContextProcessId])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, endpoint.name, event.dns.request

// HUNT: Loopback-prefixed wildcard DNS lookup (admin token theft step)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1528, T1190
// CONF: high | FP: low
// FALSE POSITIVES: developers testing local wildcard-DNS setups
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup whose name starts with 127.0.0.1 and ends in a sslip.io or nip.io wildcard zone. The match is anchored and case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne agent DNS (DNS Resolved) telemetry on the Plex host
// TUNING: Developers testing local wildcard DNS setups are the expected false positive; exclude their hosts by endpoint.name.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup the agent did not observe, such as one resolved by an in-process resolver without a system call, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '^127\\.0\\.0\\.1\\..+\\.(sslip|nip)\\.io$'
| columns event.time, endpoint.name, src.process.name, event.dns.request
| sort -event.time
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Loopback-prefixed wildcard DNS lookup (admin token theft step)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1528, T1190
// CONF: high | FP: low
// FALSE POSITIVES: developers testing local wildcard-DNS setups
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DNS responses: Defender has no endpoint DNS table, so the name is read from the DnsQueryResponse action's AdditionalFields. The regex is anchored and case-insensitive.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Developers testing local wildcard DNS setups are the expected false positive; exclude their hosts by DeviceName.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Linux DNS coverage by the sensor varies by version; a missing event type returns nothing.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(14d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)^127\.0\.0\.1\..+\.(sslip|nip)\.io$"
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, InitiatingProcessFileName, QueryName
| sort by Timestamp desc
| take 200

// HUNT: Executable written into a Plex Codecs directory by a non-server writer
// MITRE: T1129, T1190
// CONF: medium  FP: medium  COST: low
// REQUIRES: Executable-file-written telemetry (Linux ElfFileWritten, Windows PeFileWritten). Sensor classifies by file content, so a very small or malformed file may not be reported.
// FALSE POSITIVES: Plex codec downloads and updates; package or image upgrades
// TUNING: baseline the legitimate writer for 30 days, then exclude it with | ContextBaseFileName!=/^approved_updater$/i. Keep Plex Transcoder as a writer you do NOT exclude.
// LOOKBACK: 14d
#event_simpleName=/^(ElfFileWritten|PeFileWritten)$/
| TargetFileName=/Codecs/i
| ContextBaseFileName!=/^(plex media serv|plexmediaserver)/i
| table([@timestamp, ComputerName, aid, ContextBaseFileName, TargetFileName, SHA256HashData])

event.type in ('File Creation', 'File Modification') tgt.file.path = *
| limit 5
| columns event.time, endpoint.name, src.process.name, tgt.file.path

// HUNT: Executable written into a Plex Codecs directory by a non-server writer
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1129, T1190
// CONF: medium | FP: medium
// FALSE POSITIVES: Plex codec downloads and updates; package or image upgrades
// EQUIVALENCE: approximate-analytic - The CQL reads an executable-file-written event that the sensor classifies by file content. SentinelOne has no content-classified executable write event, so this hunts any file creation or modification under a Codecs path by a writer other than the Plex server, which is broader and noisier.
// REQUIRES: SentinelOne agent file telemetry (File Creation, File Modification)
// TUNING: Baseline the legitimate writer for 30 days, then exclude it by src.process.name. Keep Plex Transcoder as a writer you do not exclude.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The sensor-side executable classification is not reproduced, so non-executable writes under a Codecs path also match. A very small or malformed file may not be reported by the agent.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') tgt.file.path contains 'Codecs' !(src.process.name matches '^(plex media serv|plexmediaserver)')
| columns event.time, endpoint.name, event.type, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: Executable written into a Plex Codecs directory by a non-server writer
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1129, T1190
// CONF: medium | FP: medium
// FALSE POSITIVES: Plex codec downloads and updates; package or image upgrades
// EQUIVALENCE: approximate-analytic - The CQL reads an executable-file-written event that the sensor classifies by file content. Defender has no content-classified executable write, so this hunts any file creation or modification under a Codecs path by a writer other than the Plex server, which is broader and noisier.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Baseline the legitimate writer for 30 days, then exclude it by InitiatingProcessFileName. Keep Plex Transcoder as a writer you do not exclude.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The sensor-side executable classification is not reproduced, so non-executable writes under a Codecs path also match.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(14d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath contains "Codecs"
| where not(InitiatingProcessFileName matches regex @"(?i)^(plex media serv|plexmediaserver)")
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, SHA1
| sort by Timestamp desc
| take 200

// HUNT: Plex process outbound to public addresses on unusual ports
// MITRE: T1090, T1105
// CONF: low  FP: high  COST: medium
// REQUIRES: Outbound network connection with owning process name (validate ContextBaseFileName on your sensor)
// FALSE POSITIVES: remote streaming, relay and DLNA; metadata providers on non-standard ports
// TUNING: rank by rarity and review destinations seen on one host only; exclude your own approved relay ranges with | !cidr(RemoteAddressIP4, subnet="203.0.113.0/24")
// LOOKBACK: 14d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^plex (media serv|script hos|transcoder)/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])
| RemotePort!=443 RemotePort!=80
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count(as=conns))
| sort(conns, order=desc, limit=200)
| table([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, conns])

event.type = 'IP Connect' src.process.name = *
| limit 5
| columns event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: Plex process outbound to public addresses on unusual ports
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1105
// CONF: low | FP: high
// FALSE POSITIVES: remote streaming, relay and DLNA; metadata providers on non-standard ports
// EQUIVALENCE: approximate-analytic - Same hunt: a Plex process connecting out to a non-private address on a port other than 80 or 443, ranked by connection count. RFC 1918, loopback and link-local destinations are excluded with the same ranges as the CQL.
// REQUIRES: SentinelOne agent network (IP Connect) telemetry with the owning process name
// TUNING: Rank by rarity and review destinations seen on one host only. Exclude your own approved relay ranges with !(net_ipsubnet(dst.ip.address, '203.0.113.0/24')).
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Remote streaming, relay and DLNA traffic on unusual ports is a known false positive; this is a hunt, not a detection.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name matches '^plex (media serv|script hos|transcoder)' dst.ip.address = * !(net_rfc1918(dst.ip.address)) !(net_ipsubnet(dst.ip.address, '127.0.0.0/8')) !(net_ipsubnet(dst.ip.address, '169.254.0.0/16')) dst.port.number != 443 dst.port.number != 80
| group conns=count() by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -conns
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, RemoteIPType, RemotePort
| take 5

// HUNT: Plex process outbound to public addresses on unusual ports
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1105
// CONF: low | FP: high
// FALSE POSITIVES: remote streaming, relay and DLNA; metadata providers on non-standard ports
// EQUIVALENCE: approximate-analytic - Same hunt: a Plex process connecting out to a public address on a port other than 80 or 443, ranked by connection count. RemoteIPType equal to Public stands in for the CQL's explicit private, loopback and link-local exclusions and also drops a few other reserved ranges.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Rank by rarity and review destinations seen on one host only. Exclude your own approved relay ranges by RemoteIP after baselining.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Remote streaming, relay and DLNA traffic on unusual ports is a known false positive; this is a hunt, not a detection.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName matches regex @"(?i)^plex (media serv|script hos|transcoder)"
| where RemoteIPType == "Public"
| where RemotePort !in (80, 443)
| summarize Conns = count() by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Conns desc
| take 200