// sigma convert -t kusto -p microsoft_xdr, generated 10 Nov 2026. NOT run against a live tenant.
// ===== macos_proc_forticlient_shell_child.yml (-p microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath contains "/FortiClient.app/" or InitiatingProcessFolderPath startswith "/Library/Application Support/Fortinet/FortiClient/bin/") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/zsh" or FolderPath endswith "/osascript" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl" or FolderPath endswith "/launchctl")

// ===== win_proc_forticlient_service_task_child.yml (-p microsoft_xdr)
DeviceProcessEvents
| where ((FolderPath endswith "\\sc.exe" and ProcessCommandLine contains " create ") or (FolderPath endswith "\\schtasks.exe" and ProcessCommandLine contains "/create")) and InitiatingProcessFolderPath contains "\\Fortinet\\FortiClient\\"

// ===== win_proc_forticlient_shell_lolbin_child.yml (-p microsoft_xdr)
DeviceProcessEvents
| where InitiatingProcessFolderPath contains "\\Fortinet\\FortiClient\\" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\schtasks.exe" or FolderPath endswith "\\sc.exe" or FolderPath endswith "\\whoami.exe" or FolderPath endswith "\\wmic.exe") and (not(((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and ProcessCommandLine contains "DnsClientNrptRule")))

