EKZ Stealer (FortiEndpoint_Patch.exe) CLI credential harvesting commands

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•15

Detects the execution of command-line arguments associated with the 'FortiEndpoint_Patch.exe' binary, which is used by the EKZ Stealer malware to perform credential harvesting operations such as listing, searching, viewing, exporting, or labeling sensitive data.