// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant.
// ===== macos_proc_forticlient_shell_child.yml (--without-pipeline)
(ParentImage contains "/FortiClient.app/" or ParentImage startswith "/Library/Application Support/Fortinet/FortiClient/bin/") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/zsh" or Image endswith "/osascript" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl" or Image endswith "/launchctl")

// ===== win_proc_forticlient_service_task_child.yml (--without-pipeline)
((Image endswith "\\sc.exe" and CommandLine contains " create ") or (Image endswith "\\schtasks.exe" and CommandLine contains "/create")) and ParentImage contains "\\Fortinet\\FortiClient\\"

// ===== win_proc_forticlient_shell_lolbin_child.yml (--without-pipeline)
ParentImage contains "\\Fortinet\\FortiClient\\" and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\mshta.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\curl.exe" or Image endswith "\\schtasks.exe" or Image endswith "\\sc.exe" or Image endswith "\\whoami.exe" or Image endswith "\\wmic.exe") and (not(((Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe") and CommandLine contains "DnsClientNrptRule")))

