Detect Pre-OS Boot in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  CATEGORYNAME(category) AS event_category,
  username,
  "sourceip",
  "devicehostname" AS hostname,
  "Command" AS process_command,
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process,
  "File Path" AS file_path,
  CASE
    WHEN LOWER("Process Name") SIMILAR TO '%(rweverything|rwe\.exe|chipsec|flashrom|afuwin|afudos|winflash|biosflash|fpt\.exe|fptw|h2ouve|amibcp|amidewin|fwupdatelocalapp|firmwareupdate)%' THEN 'FirmwareToolExecution'
    WHEN (LOWER("Command") SIMILAR TO '%(physicaldrive|\.\\harddisk|\\device\\harddisk)%'
          AND LOWER("Process Name") NOT SIMILAR TO '%(defrag|chkdsk|diskpart|diskshadow|vssadmin|wbadmin|ntbackup)%'
          AND LOWER("Parent Process Name") NOT SIMILAR TO '%(services\.exe|wininit\.exe|smss\.exe)%') THEN 'RawDiskAccess'
    WHEN (LOWER("Process Name") SIMILAR TO '%bcdedit\.exe%'
          AND LOWER("Command") SIMILAR TO '%(/set|/create|/delete|/import|/store|/deletevalue)%'
          AND LOWER("Parent Process Name") NOT SIMILAR TO '%(setup\.exe|dism\.exe|msiexec\.exe|trustedinstaller|sysprep\.exe|svchost\.exe|wininit\.exe)%') THEN 'BootConfigModification'
    WHEN (LOWER("Process Name") SIMILAR TO '%bootrec\.exe%'
          AND LOWER("Command") SIMILAR TO '%(/fixmbr|/fixboot|/rebuildbcd|/scanos)%') THEN 'BootConfigModification'
    WHEN (LOWER("Process Name") SIMILAR TO '%bcdboot\.exe%'
          AND LOWER("Command") NOT SIMILAR TO '%/help%'
          AND LOWER("Parent Process Name") NOT SIMILAR TO '%(setup\.exe|dism\.exe|msiexec\.exe|trustedinstaller|sysprep\.exe|svchost\.exe|wininit\.exe)%') THEN 'BootConfigModification'
    WHEN ("File Path" IS NOT NULL
          AND LOWER("File Path") SIMILAR TO '%(\\efi\\|\\boot\\bcd|bootmgfw\.efi|bootx64\.efi|winload\.efi|grubx64\.efi|shimx64\.efi|\\bootmgr|ntldr)%'
          AND LOWER("Process Name") NOT SIMILAR TO '%(setup\.exe|dism\.exe|trustedinstaller|msiexec\.exe|fwupd|bootupd|wininit\.exe)%') THEN 'BootFileWrite'
    ELSE NULL
  END AS detection_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND starttime > NOW() - 1 DAYS
  AND (
    /* Firmware tool execution */
    LOWER("Process Name") SIMILAR TO '%(rweverything|rwe\.exe|chipsec|flashrom|afuwin|afudos|winflash|biosflash|fpt\.exe|fptw|h2ouve|amibcp|amidewin|fwupdatelocalapp|firmwareupdate)%'
    OR LOWER("Command") SIMILAR TO '%(rweverything|chipsec|flashrom|afuwin|winflash|biosflash|h2ouve|amibcp|uefi.firmware|biosupdate|uefiflash)%'
    /* Raw disk access */
    OR (
      LOWER("Command") SIMILAR TO '%(physicaldrive|\.\\harddisk|\\device\\harddisk)%'
      AND LOWER("Process Name") NOT SIMILAR TO '%(defrag|chkdsk|diskpart|diskshadow|vssadmin|wbadmin|ntbackup)%'
      AND LOWER("Parent Process Name") NOT SIMILAR TO '%(services\.exe|wininit\.exe|smss\.exe)%'
    )
    /* Boot config modification */
    OR (
      LOWER("Process Name") SIMILAR TO '%(bcdedit\.exe|bootrec\.exe|bcdboot\.exe)%'
      AND LOWER("Command") SIMILAR TO '%(/set|/create|/delete|/import|/store|/deletevalue|/fixmbr|/fixboot|/rebuildbcd|/scanos)%'
      AND LOWER("Parent Process Name") NOT SIMILAR TO '%(setup\.exe|dism\.exe|msiexec\.exe|trustedinstaller|sysprep\.exe|svchost\.exe|wininit\.exe)%'
    )
    /* Boot file writes via Sysmon event 11 */
    OR (
      "File Path" IS NOT NULL
      AND LOWER("File Path") SIMILAR TO '%(\\efi\\|\\boot\\bcd|bootmgfw\.efi|bootx64\.efi|winload\.efi|grubx64\.efi|shimx64\.efi|\\bootmgr|ntldr)%'
      AND LOWER("Process Name") NOT SIMILAR TO '%(setup\.exe|dism\.exe|trustedinstaller|msiexec\.exe|fwupd|bootupd|wininit\.exe)%'
    )
  )
ORDER BY starttime DESC