Detect Launch Agent in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "username",
  "hostname",
  "sourceip",
  QIDNAME(qid) AS event_name,
  "filename",
  "filepath",
  "command" AS process_args,
  "parentcommand" AS parent_process,
  CASE
    WHEN ISNULL("filepath") = FALSE AND "filepath" ILIKE '/System/Library/LaunchAgents/%' THEN 'System'
    WHEN ISNULL("filepath") = FALSE AND "filepath" ILIKE '/Library/LaunchAgents/%' THEN 'Global'
    ELSE 'User'
  END AS agent_scope,
  CASE
    WHEN LOWER("parentcommand") MATCHES '(^|/)bash$|(^|/)sh$|(^|/)zsh$|(^|/)python3?$|(^|/)ruby$|(^|/)perl$|(^|/)curl$|(^|/)wget$|(^|/)osascript$|(^|/)node$|(^|/)installer$|(^|/)pkgutil$' THEN 1
    ELSE 0
  END AS suspicious_writer,
  CASE
    WHEN "filename" ILIKE 'com.apple.%.%.plist' AND "filepath" NOT ILIKE '/System/Library/%' THEN 1
    ELSE 0
  END AS apple_name_spoof,
  CASE
    WHEN REGEXP("filename", 'com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist')
      AND "filename" NOT ILIKE 'com.apple.%'
      AND "filename" NOT ILIKE 'com.microsoft.%'
      AND "filename" NOT ILIKE 'com.adobe.%'
      AND "filename" NOT ILIKE 'com.google.%'
    THEN 1 ELSE 0
  END AS random_name
FROM events
WHERE
  starttime > NOW() - 1 DAYS
  AND (
    (
      CATEGORYNAME(category) ILIKE '%file%create%' OR CATEGORYNAME(category) ILIKE '%file%write%' OR CATEGORYNAME(category) ILIKE '%file%modified%'
      AND ("filepath" ILIKE '/Library/LaunchAgents/%.plist' OR "filepath" ILIKE '/System/Library/LaunchAgents/%.plist' OR "filepath" ILIKE '%/Library/LaunchAgents/%.plist')
    )
    OR (
      CATEGORYNAME(category) ILIKE '%process%'
      AND "command" ILIKE '%launchctl%'
      AND ("command" ILIKE '%load%' OR "command" ILIKE '%bootstrap%')
      AND ("command" ILIKE '%LaunchAgents%' OR "command" ILIKE '%.plist%')
    )
  )
  AND (
    CASE
      WHEN LOWER("parentcommand") MATCHES '(^|/)bash$|(^|/)sh$|(^|/)zsh$|(^|/)python3?$|(^|/)ruby$|(^|/)perl$|(^|/)curl$|(^|/)wget$|(^|/)osascript$|(^|/)node$|(^|/)installer$|(^|/)pkgutil$' THEN 1
      ELSE 0
    END +
    CASE WHEN "filename" ILIKE 'com.apple.%.%.plist' AND "filepath" NOT ILIKE '/System/Library/%' THEN 1 ELSE 0 END +
    CASE WHEN REGEXP("filename", 'com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist') AND "filename" NOT ILIKE 'com.apple.%' AND "filename" NOT ILIKE 'com.microsoft.%' THEN 1 ELSE 0 END
  ) > 0
ORDER BY event_time DESC