Detect Server Software Component in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  CATEGORYNAME(category) AS category_name,
  QIDNAME(qid) AS event_name,
  username,
  sourceip,
  hostname,
  "ParentImage",
  "CommandLine",
  "Image",
  "TargetFilename",
  "TargetObject",
  "Details",
  CASE
    WHEN LOWER("Image") LIKE '%cmd.exe' OR LOWER("Image") LIKE '%powershell.exe'
      OR LOWER("Image") LIKE '%pwsh.exe' OR LOWER("Image") LIKE '%wscript.exe'
      OR LOWER("Image") LIKE '%cscript.exe' OR LOWER("Image") LIKE '%mshta.exe' THEN 'Critical'
    WHEN "EventCode" IN ('1') THEN 'High'
    WHEN "EventCode" IN ('11','13') THEN 'High'
    ELSE 'Medium'
  END AS severity_rating,
  CASE
    WHEN "EventCode" = '1' THEN 'WebShell_ChildProcess'
    WHEN "EventCode" = '11' THEN 'SuspiciousWebFile_Written'
    WHEN "EventCode" = '13' THEN 'IIS_Module_Registered'
    ELSE 'Unknown'
  END AS detection_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%sysmon%'
  AND starttime > NOW() - 86400 SECONDS
  AND (
    -- Signal 1: Web server spawning suspicious child processes
    (
      "EventCode" = '1'
      AND (
        LOWER("ParentImage") LIKE '%w3wp.exe' OR LOWER("ParentImage") LIKE '%httpd.exe'
        OR LOWER("ParentImage") LIKE '%nginx.exe' OR LOWER("ParentImage") LIKE '%tomcat%'
        OR LOWER("ParentImage") LIKE '%java.exe' OR LOWER("ParentImage") LIKE '%php-cgi.exe'
        OR LOWER("ParentImage") LIKE '%perl.exe' OR LOWER("ParentImage") LIKE '%python.exe'
        OR LOWER("ParentImage") LIKE '%ruby.exe' OR LOWER("ParentImage") LIKE '%node.exe'
      )
      AND (
        LOWER("Image") LIKE '%cmd.exe' OR LOWER("Image") LIKE '%powershell.exe'
        OR LOWER("Image") LIKE '%pwsh.exe' OR LOWER("Image") LIKE '%wscript.exe'
        OR LOWER("Image") LIKE '%cscript.exe' OR LOWER("Image") LIKE '%mshta.exe'
        OR LOWER("Image") LIKE '%rundll32.exe' OR LOWER("Image") LIKE '%regsvr32.exe'
        OR LOWER("Image") LIKE '%certutil.exe' OR LOWER("Image") LIKE '%net.exe'
        OR LOWER("Image") LIKE '%net1.exe' OR LOWER("Image") LIKE '%whoami.exe'
        OR LOWER("Image") LIKE '%systeminfo.exe' OR LOWER("Image") LIKE '%nltest.exe'
        OR LOWER("Image") LIKE '%curl.exe' OR LOWER("Image") LIKE '%wget.exe'
      )
    )
    OR
    -- Signal 2: Web shell file written to web root
    (
      "EventCode" = '11'
      AND (
        LOWER("TargetFilename") LIKE '%\\inetpub\\%' OR LOWER("TargetFilename") LIKE '%\\wwwroot\\%'
        OR LOWER("TargetFilename") LIKE '%\\htdocs\\%' OR LOWER("TargetFilename") LIKE '%\\webapps\\%'
        OR LOWER("TargetFilename") LIKE '%\\public_html\\%' OR LOWER("TargetFilename") LIKE '%/var/www/%'
      )
      AND (
        LOWER("TargetFilename") LIKE '%.aspx' OR LOWER("TargetFilename") LIKE '%.asp'
        OR LOWER("TargetFilename") LIKE '%.php' OR LOWER("TargetFilename") LIKE '%.jsp'
        OR LOWER("TargetFilename") LIKE '%.jspx' OR LOWER("TargetFilename") LIKE '%.cfm'
        OR LOWER("TargetFilename") LIKE '%.ashx' OR LOWER("TargetFilename") LIKE '%.asmx'
        OR LOWER("TargetFilename") LIKE '%.phtml'
      )
      AND LOWER("Image") NOT LIKE '%msiexec.exe'
      AND LOWER("Image") NOT LIKE '%setup.exe'
      AND LOWER("Image") NOT LIKE '%devenv.exe'
      AND LOWER("Image") NOT LIKE '%code.exe'
      AND LOWER("Image") NOT LIKE '%explorer.exe'
      AND LOWER("Image") NOT LIKE '%robocopy.exe'
    )
    OR
    -- Signal 3: IIS module registered via registry
    (
      "EventCode" = '13'
      AND (
        LOWER("TargetObject") LIKE '%\\currentcontrolset\\services\\w3svc%'
        OR LOWER("TargetObject") LIKE '%\\software\\microsoft\\inetstp%'
        OR LOWER("TargetObject") LIKE '%\\currentcontrolset\\services\\was%'
      )
      AND LOWER("Details") LIKE '%.dll'
      AND LOWER("Image") NOT LIKE '%msiexec.exe'
      AND LOWER("Image") NOT LIKE '%trustedinstaller.exe'
      AND LOWER("Image") NOT LIKE '%wusa.exe'
    )
  )
ORDER BY starttime DESC