FortiClient scheduler.exe → FortiTray.exe → cmd.exe → encoded PowerShell execution chain

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•4

Detects instances where FortiTray.exe or scheduler.exe (associated with FortiClient) initiate a cmd.exe process that subsequently launches a PowerShell process with hidden window (-w 1) and encoded command (-enc) flags. This pattern is indicative of a living-off-the-land attack where a legitimate, signed application process is abused to execute obfuscated malicious payloads.