EKZ Stealer masquerading as FortiEndpoint_Patch.exe with credential CLI commands

Ibrahim Saud@tektrix

•updated Jul 3, 2026•3•0•4

This rule detects the execution of the 'FortiEndpoint_Patch.exe' binary when command-line arguments typically used for status queries, data retrieval, or export tasks (such as 'list', 'search', 'view', or 'export') are passed to it. This monitoring identifies potential reconnaissance or information gathering activities performed by an attacker interacting with Fortinet endpoint management utilities.