Detect Dead Drop Resolver in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  destinationip,
  destinationport,
  username,
  URL,
  LOGSOURCENAME(logsourceid) AS LogSource,
  CATEGORYNAME(category) AS EventCategory,
  "ApplicationProtocol",
  devicehostname AS HostName,
  LOGSOURCETYPEID(logsourceid) AS SourceType,
  CASE
    WHEN URL MATCHES '(?i).*(pastebin\.com|pastebin\.pl|paste\.ee|hastebin\.com).*' THEN 1
    ELSE 0
  END AS IsPastebin,
  CASE
    WHEN URL MATCHES '(?i).*(raw\.githubusercontent\.com|gist\.github\.com).*' THEN 1
    ELSE 0
  END AS IsGitHubRaw,
  CASE
    WHEN URL MATCHES '(?i).*(api\.twitter\.com|reddit\.com|livejournal\.com).*' THEN 1
    ELSE 0
  END AS IsSocialMedia,
  CASE
    WHEN URL MATCHES '(?i).*(amazonaws\.com|docs\.google\.com|drive\.google\.com|onedrive\.live\.com|sharepoint\.com).*' THEN 1
    ELSE 0
  END AS IsCloudStorage,
  CASE
    WHEN "Process Name" MATCHES '(?i).*(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|curl\.exe|wget\.exe|bitsadmin\.exe|python\.exe|python3\.exe|java\.exe|msiexec\.exe).*' THEN 1
    ELSE 0
  END AS IsSuspiciousProcess
FROM events
WHERE
  starttime > NOW() - 1 DAYS
  AND (
    URL MATCHES '(?i).*(pastebin\.com|pastebin\.pl|paste\.ee|hastebin\.com|raw\.githubusercontent\.com|gist\.github\.com|api\.twitter\.com|t\.co|docs\.google\.com|drive\.google\.com|sites\.google\.com|youtube\.com|technet\.microsoft\.com|livejournal\.com|imgur\.com|reddit\.com|workers\.dev|amazonaws\.com|s3\.amazonaws\.com|onedrive\.live\.com|sharepoint\.com|notion\.so|trello\.com|discord\.com|discordapp\.com|telegram\.org|t\.me).*'
  )
  AND (
    "Process Name" MATCHES '(?i).*(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|curl\.exe|wget\.exe|bitsadmin\.exe|python\.exe|python3\.exe|perl\.exe|ruby\.exe|java\.exe|msiexec\.exe).*'
    OR NOT "Process Name" MATCHES '(?i).*(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe|safari\.exe|outlook\.exe|teams\.exe|slack\.exe|onedrive\.exe|dropbox\.exe|svchost\.exe).*'
  )
ORDER BY starttime DESC
LIMIT 500