// sigma convert -t kusto -p azure_monitor, generated 10 Nov 2026. NOT run against a live tenant.
// ===== macos_proc_forticlient_shell_child.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName contains "/FortiClient.app/" or ParentProcessName startswith "/Library/Application Support/Fortinet/FortiClient/bin/") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/zsh" or NewProcessName endswith "/osascript" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl" or NewProcessName endswith "/launchctl")

// ===== win_proc_forticlient_service_task_child.yml (-p azure_monitor)
SecurityEvent
| where ((NewProcessName endswith "\\sc.exe" and CommandLine contains " create ") or (NewProcessName endswith "\\schtasks.exe" and CommandLine contains "/create")) and ParentProcessName contains "\\Fortinet\\FortiClient\\"

// ===== win_proc_forticlient_shell_lolbin_child.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName contains "\\Fortinet\\FortiClient\\" and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\curl.exe" or NewProcessName endswith "\\schtasks.exe" or NewProcessName endswith "\\sc.exe" or NewProcessName endswith "\\whoami.exe" or NewProcessName endswith "\\wmic.exe") and (not(((NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe") and CommandLine contains "DnsClientNrptRule")))

