FortiClient EMS scheduler.exe spawning FortiTray.exe (FortiBleed chain)
Detects instances where the FortiTray.exe process is launched by the FortiClient scheduler (scheduler.exe). This pattern is typical of standard FortiClient operation, but can be used as a baseline for monitoring application behavior.
Microsoft Sentinel (KQL)
