I ran into this issue too. To make it easier for others to figure out if they're affected, I created a common reliability enumeration (CRE). You can preview the rule here or run it against your logs here.