Detect Code Signing Policy Modification in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "hostname",
  QIDNAME(qid) AS event_name,
  CATEGORYNAME(category) AS category_name,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Target Object" AS registry_target,
  "Details" AS registry_value,
  CASE
    WHEN LOWER("Command") LIKE '%nointegritychecks%' AND LOWER("Command") LIKE '%on%' THEN 'critical'
    WHEN LOWER("Command") LIKE '%testsigning%' AND LOWER("Command") LIKE '%on%' THEN 'high'
    WHEN LOWER("Target Object") LIKE '%HypervisorEnforcedCodeIntegrity%' THEN 'critical'
    WHEN LOWER("Target Object") LIKE '%RequireSignedAppInit_DLLs%' THEN 'high'
    WHEN LOWER("Target Object") LIKE '%EnableVirtualizationBasedSecurity%' THEN 'high'
    ELSE 'medium'
  END AS severity,
  CASE
    WHEN "Process Name" LIKE '%bcdedit%' THEN 'BCD_Policy_Modification'
    WHEN "Target Object" LIKE '%DeviceGuard%' OR "Target Object" LIKE '%CI%' THEN 'Registry_CI_Modification'
    ELSE 'Code_Signing_Policy_Change'
  END AS detection_type
FROM events
WHERE
  starttime > NOW() - 1 DAYS
  AND (
    (
      LOGSOURCETYPEID = 119  -- Microsoft Windows Security Event Log
      AND qid IN (
        SELECT qid FROM qidmap WHERE eventid IN (4688, 4657)
      )
      AND (
        ("Process Name" ILIKE '%bcdedit%'
          AND (LOWER("Command") LIKE '%testsigning%'
               OR LOWER("Command") LIKE '%nointegritychecks%'
               OR LOWER("Command") LIKE '%bootdebug%'))
        OR
        ("Object Name" ILIKE '%RequireSignedAppInit%'
          OR "Object Name" ILIKE '%DeviceGuard%'
          OR "Object Name" ILIKE '%\\Control\\CI%'
          OR "Object Name" ILIKE '%CodeIntegrity%')
      )
    )
    OR
    (
      LOGSOURCETYPEID = 215  -- Sysmon
      AND (
        (qid IN (SELECT qid FROM qidmap WHERE eventid = 1)
          AND LOWER("Image") LIKE '%bcdedit%'
          AND (LOWER("CommandLine") LIKE '%testsigning%'
               OR LOWER("CommandLine") LIKE '%nointegritychecks%'
               OR LOWER("CommandLine") LIKE '%bootdebug%'))
        OR
        (qid IN (SELECT qid FROM qidmap WHERE eventid = 13)
          AND (
            "TargetObject" ILIKE '%RequireSignedAppInit_DLLs%'
            OR "TargetObject" ILIKE '%LoadAppInit_DLLs%'
            OR "TargetObject" ILIKE '%HypervisorEnforcedCodeIntegrity%'
            OR "TargetObject" ILIKE '%EnableVirtualizationBasedSecurity%'
            OR "TargetObject" ILIKE '%RequirePlatformSecurityFeatures%'
            OR "TargetObject" ILIKE '%\\Control\\CI\\%'
            OR "TargetObject" ILIKE '%\\Control\\CodeIntegrity%'
          )
        )
      )
    )
  )
ORDER BY starttime DESC