FortiClient EMS FCMDaemon Spawning Suspicious Child Process

Ankit Mehta@Secvyn

•updated 8 days ago•0•0•0

Detects instances where FortiClient EMS management daemon processes (FCMDaemon.exe, FortiClient_Server.exe, or FCMWebServer.exe) spawn suspicious child processes often associated with living-off-the-land techniques, such as command shells, scripting interpreters, or system administrative utilities.