PowerShell injection into FortiClient VPN config .cmd scripts

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•4

Detects the execution of encoded PowerShell commands initiated by a .cmd script associated with a FortiClient VPN configuration. This activity is indicative of the FortiBleed post-exploitation chain, where an attacker injects malicious PowerShell into VPN configuration scripts via a compromised FortiClient EMS admin API.