FortiClient scheduler.exe spawning cmd.exe and encoded PowerShell (FortiBleed)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•11

This rule detects a suspicious process execution chain where the FortiClient scheduler (scheduler.exe) initiates a command-line interpreter (cmd.exe) to execute a batch file, which subsequently launches a PowerShell process with obfuscated or hidden command-line arguments (e.g., -w 1, -enc). This chain is often indicative of post-exploitation activity, specifically related to the FortiBleed vulnerability chain or the deployment of infostealers.