EKZ Stealer FortiEndpoint_Patch.exe Execution and Credential Log Drop

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•6

Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.