Detect Remote Data Staging in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "QIDNAME(qid)" AS event_name,
  "CATEGORYNAME(category)" AS category,
  LOGSOURCENAME(logsourceid) AS log_source,
  "CommandLine",
  "ParentImage",
  "Image",
  "TargetFilename",
  CASE
    WHEN LOWER("TargetFilename") MATCHES '.*\.(zip|rar|7z|tar\.gz|gz|bz2|cab|iso)$'
         AND LOWER("TargetFilename") MATCHES '.*(\\temp\\|\\tmp\\|\\public\\|\\programdata\\|\\appdata\\local\\temp\\|\\users\\public\\|\\inetpub\\wwwroot\\).*'
    THEN 'ArchiveInStagingDir'
    WHEN LOWER("Image") MATCHES '.*(xcopy\.exe|robocopy\.exe)$'
         AND "CommandLine" MATCHES '.*\\\\[a-zA-Z0-9].*'
    THEN 'RemoteCopyToolToUNC'
    WHEN LOWER("Image") MATCHES '.*(powershell\.exe|pwsh\.exe|cmd\.exe)$'
         AND LOWER("CommandLine") MATCHES '.*(copy-item|move-item|xcopy|robocopy|copy |move ).*'
         AND "CommandLine" MATCHES '.*\\\\[a-zA-Z0-9].*'
    THEN 'PSCmdRemoteCopy'
    ELSE 'OtherStagingIndicator'
  END AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID IN (12) -- Sysmon
  AND qid IN (
    SELECT qid FROM qidmap WHERE qidname IN ('Process Create', 'File created')
  )
  AND (
    (
      LOWER("TargetFilename") MATCHES '.*\.(zip|rar|7z|tar|gz|bz2|cab|iso|lzh|arj)$'
      AND LOWER("TargetFilename") MATCHES '.*(\\temp\\|\\tmp\\|\\public\\|\\programdata\\|\\appdata\\local\\temp\\|\\users\\public\\|\\inetpub\\|\\wwwroot\\).*'
    )
    OR (
      LOWER("Image") MATCHES '.*(xcopy\.exe|robocopy\.exe)$'
      AND "CommandLine" MATCHES '.*\\\\[a-zA-Z0-9].*'
    )
    OR (
      LOWER("Image") MATCHES '.*(powershell\.exe|pwsh\.exe|cmd\.exe)$'
      AND LOWER("CommandLine") MATCHES '.*(copy-item|move-item|xcopy|robocopy).*'
      AND "CommandLine" MATCHES '.*\\\\[a-zA-Z0-9].*'
    )
  )
  AND starttime > (NOW() - 86400000)
ORDER BY starttime DESC
LAST 24 HOURS