FortiEndpoint_Patch.exe Masquerade and ElevationKatz Invocation (EKZ Stealer)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•2

Detects the presence and execution of 'FortiEndpoint_Patch.exe' from non-standard locations (C:\ProgramData) used for masquerading, or the invocation of the ElevationKatz command-line tool (runhlp.exe --v20-decrypt) used to perform credential decryption.