All the research of half an hour says that FIN-only is never legitimate.
Packets should never contain just a FIN flag. FIN packets are
frequently used for port scans, network mapping and other stealth
Send an unsolicited ACK to an open or closed port and you will get
back a plain RST. A FIN will never appear by itself which is why
Cisco's "established" keyword filters on ACK and/or RST packets. Only
FIN/ACK is valid.
Other Stack Exchange sites, such as https://security.stackexchange.com/, possibly https://superuser.com/, might be better in the context of discussing IDS/IPS topics.
(With tip'o'the hat to Ron Maupin, see his comment): The TCP RFC does not (edited, it must've been late...) explicitely state that a FIN only packet is illegal nor that a FIN flag MUST be accompanied by another flag. Still, a FIN only packet in a modern day network is something unusual, quite possibly intentional, this probably worth looking at and for.