Detect System Firmware in Sumo Logic CSE

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*wineventlog*)
| where EventCode in ("1", "6", "11", "7045", "4688")
| parse field=Message "Image: *" as Image nodrop
| parse field=Message "CommandLine: *" as CommandLine nodrop
| parse field=Message "ImageLoaded: *" as ImageLoaded nodrop
| parse field=Message "TargetFilename: *" as TargetFilename nodrop
| parse field=Message "ServiceName: *" as ServiceName nodrop
| parse field=Message "ServiceFileName: *" as ServiceFileName nodrop
| parse field=Message "Signed: *" as Signed nodrop
| parse field=Message "Hashes: *" as Hashes nodrop
| where (
    (
      EventCode in ("1", "4688") and (
        Image matches "*chipsec.exe" or Image matches "*flashrom.exe" or
        Image matches "*RWEverything.exe" or Image matches "*RwDrv.exe" or
        Image matches "*AFUWIN.exe" or Image matches "*AFUWIN64.exe" or
        Image matches "*fpt.exe" or Image matches "*fptw.exe" or Image matches "*fptw64.exe" or
        Image matches "*FWUpdate.exe" or Image matches "*biosflash.exe" or
        Image matches "*meinfo.exe" or Image matches "*UEFITool.exe" or
        Image matches "*iflash.exe" or Image matches "*AmiBIOSCoreUtil.exe" or
        CommandLine matches "*chipsec*" or CommandLine matches "*flashrom*" or
        CommandLine matches "*SpiFlash*" or CommandLine matches "*bios.rom*" or
        CommandLine matches "*uefi.rom*" or CommandLine matches "*bios_backup*" or
        CommandLine matches "*flash_bios*" or CommandLine matches "*RWEverything*" or
        CommandLine matches "*writephysmem*" or CommandLine matches "*readphysmem*"
      )
    )
    or
    (
      EventCode = "6" and (
        ImageLoaded matches "*RwDrv.sys*" or ImageLoaded matches "*sednit.sys*" or
        ImageLoaded matches "*chipsec.sys*" or ImageLoaded matches "*WinIo.sys*" or
        ImageLoaded matches "*WinIo64.sys*" or ImageLoaded matches "*PhyMemX64.sys*" or
        ImageLoaded matches "*DirectIO64.sys*" or ImageLoaded matches "*asmmap64.sys*" or
        ImageLoaded matches "*gdrv.sys*" or ImageLoaded matches "*bsflash64.sys*" or
        ImageLoaded matches "*inpoutx64.sys*" or ImageLoaded matches "*hwrwdrv.sys*" or
        ImageLoaded matches "*lenovoemc.sys*" or ImageLoaded matches "*atkwio.sys*"
      )
    )
    or
    (
      EventCode = "7045" and (
        (
          (ServiceFileName matches "*\\Temp\\*" or ServiceFileName matches "*\\Users\\*" or
           ServiceFileName matches "*\\ProgramData\\*" or ServiceFileName matches "*\\Downloads\\*")
          and ServiceFileName matches "*.sys"
        )
        or ServiceName matches "*RwDrv*" or ServiceName matches "*chipsec*" or
        ServiceName matches "*WinIo*" or ServiceName matches "*DirectIO*" or
        ServiceName matches "*PhyMem*" or ServiceName matches "*asmmap*" or
        ServiceName matches "*gdrv*" or ServiceName matches "*inpout*"
      )
    )
    or
    (
      EventCode = "11" and (
        TargetFilename matches "*.rom" or TargetFilename matches "*.fd" or
        TargetFilename matches "*.cap" or
        (
          TargetFilename matches "*.bin" and
          not TargetFilename matches "*\\Windows\\*" and
          not TargetFilename matches "*\\Program Files\\*"
        )
      )
      and not (
        Image matches "*svchost.exe*" or Image matches "*MsMpEng.exe*" or
        Image matches "*TrustedInstaller.exe*"
      )
    )
  )
| eval DetectionType = if(EventCode in ("1","4688"), "FirmwareTool_Execution",
    if(EventCode = "6", "HardwareAccess_Driver_Load",
    if(EventCode = "7045", "SuspiciousKernelDriver_Installed",
    if(EventCode = "11", "FirmwareImage_FileCreated", "Unknown"))))
| eval IndicatorDetail = if(EventCode in ("1","4688"), concat("Process: ", Image, " | CMD: ", CommandLine),
    if(EventCode = "6", concat("Driver: ", ImageLoaded, " | Signed: ", Signed),
    if(EventCode = "7045", concat("Service: ", ServiceName, " | Path: ", ServiceFileName),
    if(EventCode = "11", concat("File: ", TargetFilename, " | By: ", Image), ""))))
| table _messagetime, Computer, User, DetectionType, IndicatorDetail, Hashes
| sort by _messagetime desc