Detect System Firmware in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  devicestring AS Host,
  username AS User,
  QIDNAME(qid) AS EventName,
  "Process Name" AS ProcessName,
  "Command Line" AS CommandLine,
  "Image Loaded" AS ImageLoaded,
  "Target Filename" AS TargetFilename,
  "Service Name" AS ServiceName,
  "Service File Name" AS ServiceFileName,
  magnitude AS RiskScore
FROM events
WHERE LOGSOURCETYPEID IN (
  SELECT id FROM log_source_types
  WHERE name IN ('Microsoft Windows Security Event Log', 'Microsoft Sysmon')
)
AND starttime > NOW() - INTERVAL '1440' MINUTES
AND (
  (
    (QIDNAME(qid) LIKE '%Process Create%' OR QIDNAME(qid) LIKE '%new process has been created%')
    AND (
      "Process Name" ILIKE ANY (
        '%chipsec.exe', '%flashrom.exe', '%RWEverything.exe', '%RwDrv.exe',
        '%AFUWIN.exe', '%AFUWIN64.exe', '%fpt.exe', '%fptw.exe', '%fptw64.exe',
        '%FWUpdate.exe', '%biosflash.exe', '%meinfo.exe', '%meinfowin.exe',
        '%UEFITool.exe', '%iflash.exe', '%AmiBIOSCoreUtil.exe'
      )
      OR "Command Line" ILIKE ANY (
        '%chipsec%', '%flashrom%', '%SpiFlash%', '%bios.rom%', '%uefi.rom%',
        '%bios.bin%', '%bios_backup%', '%flash_bios%', '%RWEverything%',
        '%writephysmem%', '%readphysmem%'
      )
    )
  )
  OR (
    QIDNAME(qid) LIKE '%Driver Loaded%'
    AND "Image Loaded" ILIKE ANY (
      '%RwDrv.sys%', '%sednit.sys%', '%chipsec.sys%', '%WinIo.sys%',
      '%WinIo64.sys%', '%PhyMemX64.sys%', '%DirectIO64.sys%', '%asmmap64.sys%',
      '%gdrv.sys%', '%bsflash64.sys%', '%inpoutx64.sys%', '%hwrwdrv.sys%',
      '%lenovoemc.sys%', '%atkwio.sys%'
    )
  )
  OR (
    QIDNAME(qid) LIKE '%New Service Installed%'
    AND (
      (
        "Service File Name" ILIKE ANY ('%\\Temp\\%', '%\\Users\\%', '%\\ProgramData\\%', '%\\Downloads\\%')
        AND "Service File Name" ILIKE '%.sys%'
      )
      OR "Service Name" ILIKE ANY (
        '%RwDrv%', '%chipsec%', '%WinIo%', '%DirectIO%', '%PhyMem%',
        '%asmmap%', '%gdrv%', '%inpout%'
      )
    )
  )
  OR (
    QIDNAME(qid) LIKE '%File Created%'
    AND "Target Filename" ILIKE ANY ('%.rom', '%.fd', '%.cap')
    AND "Process Name" NOT ILIKE ANY ('%svchost.exe%', '%MsMpEng.exe%', '%TrustedInstaller.exe%')
  )
)
ORDER BY starttime DESC