FortiClient scheduler.exe spawning FortiTray.exe (post-exploitation execution)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•15

Detects instances where the FortiClient scheduler executable (scheduler.exe) spawns FortiTray.exe as a child process. While typically a legitimate operational behavior for the FortiClient application, this pattern is monitored to identify potential abuse where a trusted binary is leveraged as a proxy to execute secondary processes.