---
title: FortiClientEMS Spawning System Shell
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects FortiClientEMS service spawning cmd.exe or powershell.exe, indicating potential post-exploitation activity or webshell execution.
references:
  - https://fortiguard.com/encyclopedia/ips/47755
  - https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \'FortiClientEMS.exe\'
    Image|endswith:
      - \'\cmd.exe\'
      - \'\powershell.exe\'
      - \'\pwsh.exe\'
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: FortiClientEMS Suspicious File Creation
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects creation of executables or scripts within the FortiClientEMS directory tree by the EMS process itself, suggesting web upload or drop.
references:
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection:
    Image|endswith: \'FortiClientEMS.exe\'
    TargetFilename|contains: \'Fortinet\'
    TargetFilename|endswith:
      - \'.exe\'
      - \'.dll\'
      - \'.bat\'
      - \'.vbs\'
      - \'.ps1\'
  condition: selection
falsepositives:
  - Software updates or legitimate plugin installations
level: high

// Hunt for suspicious parent-child process relationships involving FortiClientEMS
DeviceProcessEvents
| where InitiatingProcessFileName =~ "FortiClientEMS.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName, FolderPath
| order by Timestamp desc

-- Hunt for EMS process spawning shells
SELECT Parent.ProcessId AS ParentPid,
       Parent.Name AS ParentName,
       Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
LEFT JOIN pslist() AS Parent ON Parent.Pid = Ppid
WHERE Parent.Name =~ "FortiClientEMS.exe"
   AND (Name =~ "cmd.exe" OR Name =~ "powershell.exe" OR Name =~ "pwsh.exe")

# FortiClientEMS Vulnerability Auditor
# Checks for the presence of the vulnerable executable and version.

$targetPath = "${env:ProgramFiles(x86)}\Fortinet\FortiClientEMS"
$targetExe = "FortiClientEMS.exe"
$fullPath = Join-Path -Path $targetPath -ChildPath $targetExe

# NOTE: Update this version string with the HOTFIX version from the advisory.
# If the installed version is LOWER than this, the system is vulnerable.
# Example: "7.2.0.0" 
$safeVersion = "7.2.0.0" 

if (Test-Path $fullPath) {
    $fileInfo = Get-Item $fullPath
    $currentVersion = $fileInfo.VersionInfo.FileVersion
    Write-Host "[+] Detected FortiClientEMS at: $fullPath" -ForegroundColor Cyan
    Write-Host "[+] Installed Version: $currentVersion" -ForegroundColor Cyan
    
    if ([version]$currentVersion -lt [version]$safeVersion) {
        Write-Host "[!] ALERT: Version is vulnerable. Upgrade to $safeVersion or higher immediately." -ForegroundColor Red
        Write-Host "[!] Advisory: FG-IR-26-099" -ForegroundColor Red
    } else {
        Write-Host "[*] Version appears patched based on input baseline." -ForegroundColor Green
    }
} else {
    Write-Host "[-] FortiClientEMS not found at default path." -ForegroundColor Gray
}