FCDBLog.exe - creating and modifying hosts file

We recently observed a concerning event on one of our endpoints involving the FortiClient Logging Daemon (FCDBLog.exe).

While FortiClient is a trusted security solution in our environment, we are puzzled by this behavior. Typically, security tools monitor the hosts file for unauthorized changes—not modify it directly. The involvement of a scheduled task and the elevated privileges make this worth investigating further.

Key Details:

• Process: fcdblog.exe (FortiClient Logging Daemon v7.4.3.1790)
• Parent Process: scheduler.exe
• Account: SYSTEM / NT AUTHORITY
• Command Line: FCDBLog.exe -s FC_{GUID}_000011

Questions:

1. Is this behavior expected in certain FortiClient configurations?
2. Could this be part of a diagnostic or telemetry routine?
3. Are there known cases where FortiClient modifies the hosts file intentionally?
4. What steps can we take to verify the legitimacy of this action?

Thanks in advance for your help

BR

Stephan