Encoded PowerShell (-w 1 -enc) Execution Following FortiClient EMS Compromise

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•6

Detects execution of PowerShell with encoded commands ('-enc') and window style hidden ('-w 1') initiated by processes associated with Fortinet FortiClient (e.g., scheduler.exe, fortitray.exe), or matching known encoded command patterns. This often indicates the use of legitimate management processes to execute obfuscated malicious scripts.