// sigma convert -t kusto -p sentinel_asim, generated 10 Nov 2026. NOT run against a live tenant.
// ===== macos_proc_forticlient_shell_child.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName contains "/FortiClient.app/" or ActingProcessName contains "/FortiClient.app/") or (ParentProcessName startswith "/Library/Application Support/Fortinet/FortiClient/bin/" or ActingProcessName startswith "/Library/Application Support/Fortinet/FortiClient/bin/")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/zsh" or TargetProcessName endswith "/osascript" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/launchctl")

// ===== win_proc_forticlient_service_task_child.yml (-p sentinel_asim)
imProcessCreate
| where ((TargetProcessName endswith "\\sc.exe" and TargetProcessCommandLine contains " create ") or (TargetProcessName endswith "\\schtasks.exe" and TargetProcessCommandLine contains "/create")) and (ParentProcessName contains "\\Fortinet\\FortiClient\\" or ActingProcessName contains "\\Fortinet\\FortiClient\\")

// ===== win_proc_forticlient_shell_lolbin_child.yml (-p sentinel_asim)
imProcessCreate
| where (ParentProcessName contains "\\Fortinet\\FortiClient\\" or ActingProcessName contains "\\Fortinet\\FortiClient\\") and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\curl.exe" or TargetProcessName endswith "\\schtasks.exe" or TargetProcessName endswith "\\sc.exe" or TargetProcessName endswith "\\whoami.exe" or TargetProcessName endswith "\\wmic.exe") and (not(((TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe") and TargetProcessCommandLine contains "DnsClientNrptRule")))

