FortiBleed: scheduler.exe spawning cmd.exe/.cmd and encoded PowerShell

Ibrahim Saud@tektrix

•updated Jul 3, 2026•10•0•19

Detects anomalous process execution chains where Fortinet FortiClient scheduler processes (scheduler.exe or FortiTray.exe) spawn cmd.exe to execute command scripts, or subsequently spawn PowerShell with obfuscated command line arguments (-enc, -EncodedCommand) and hidden window flags (-w 1), as identified in the FortiBleed campaign.