Detect Browser Information Discovery in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  LOGSOURCETYPENAME(devicetype) AS LogSourceType,
  sourceip AS SourceIP,
  username AS Username,
  "Machine Identifier" AS Hostname,
  "Process Name" AS ProcessName,
  "Process Path" AS ProcessPath,
  "Command Line" AS CommandLine,
  "Target Filename" AS TargetFilename,
  QIDNAME(qid) AS EventName,
  CASE
    WHEN LOWER("Process Name") MATCHES '(?i)(powershell|pwsh|cmd|wscript|cscript|mshta)' THEN 1
    ELSE 0
  END +
  CASE
    WHEN LOWER("Process Name") MATCHES '(?i)(python3?\.exe|pythonw\.exe)' THEN 1
    ELSE 0
  END +
  CASE
    WHEN LOWER("Process Name") MATCHES '(?i)(7z|winrar|zip|robocopy|xcopy|tar)\.exe' THEN 1
    ELSE 0
  END +
  CASE
    WHEN LOWER("Process Path") MATCHES '(?i)(\\\\temp\\\\|\\\\appdata\\\\roaming\\\\|\\\\downloads\\\\|\\\\public\\\\)' THEN 1
    ELSE 0
  END AS RiskScore,
  CASE
    WHEN LOWER("Target Filename") LIKE '%\\google\\chrome\\%' THEN 'Chrome'
    WHEN LOWER("Target Filename") LIKE '%\\microsoft\\edge\\%' THEN 'Edge'
    WHEN LOWER("Target Filename") LIKE '%\\mozilla\\firefox\\%' THEN 'Firefox'
    WHEN LOWER("Target Filename") LIKE '%places.sqlite%' THEN 'Firefox'
    WHEN LOWER("Target Filename") LIKE '%logins.json%' THEN 'Firefox'
    WHEN LOWER("Target Filename") LIKE '%key4.db%' THEN 'Firefox'
    WHEN LOWER("Target Filename") LIKE '%\\bravesoftware\\%' THEN 'Brave'
    WHEN LOWER("Target Filename") LIKE '%\\vivaldi\\%' THEN 'Vivaldi'
    ELSE 'Unknown'
  END AS BrowserTarget
FROM events
WHERE
  "EventID" = '11'
  AND (
    LOWER("Target Filename") LIKE '%\\google\\chrome\\user data\\%'
    OR LOWER("Target Filename") LIKE '%\\microsoft\\edge\\user data\\%'
    OR LOWER("Target Filename") LIKE '%\\mozilla\\firefox\\profiles\\%'
    OR LOWER("Target Filename") LIKE '%\\bravesoftware\\brave-browser\\user data\\%'
    OR LOWER("Target Filename") LIKE '%\\opera software\\opera stable\\%'
    OR LOWER("Target Filename") LIKE '%\\vivaldi\\user data\\%'
  )
  AND (
    LOWER("Target Filename") LIKE '%history%'
    OR LOWER("Target Filename") LIKE '%bookmarks%'
    OR LOWER("Target Filename") LIKE '%login data%'
    OR LOWER("Target Filename") LIKE '%cookies%'
    OR LOWER("Target Filename") LIKE '%web data%'
    OR LOWER("Target Filename") LIKE '%places.sqlite%'
    OR LOWER("Target Filename") LIKE '%logins.json%'
    OR LOWER("Target Filename") LIKE '%key4.db%'
    OR LOWER("Target Filename") LIKE '%localstate%'
    OR LOWER("Target Filename") LIKE '%favicons%'
  )
  AND NOT (
    LOWER("Process Name") LIKE '%chrome.exe'
    OR LOWER("Process Name") LIKE '%msedge.exe'
    OR LOWER("Process Name") LIKE '%firefox.exe'
    OR LOWER("Process Name") LIKE '%brave.exe'
    OR LOWER("Process Name") LIKE '%chromium.exe'
    OR LOWER("Process Name") LIKE '%vivaldi.exe'
    OR LOWER("Process Name") LIKE '%opera.exe'
    OR LOWER("Process Name") LIKE '%msedgewebview2.exe'
    OR LOWER("Process Name") LIKE '%msmpeeng.exe'
    OR LOWER("Process Name") LIKE '%searchindexer.exe'
    OR LOWER("Process Name") LIKE '%sgrmbroker.exe'
    OR LOWER("Process Name") LIKE '%compattelrunner.exe'
    OR LOWER("Process Name") LIKE '%tiworker.exe'
  )
LAST 24 HOURS
ORDER BY RiskScore DESC, starttime DESC