Detect Archive via Library in IBM QRadar

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  username AS UserName,
  sourceip AS HostIP,
  "Image" AS ProcessPath,
  "CommandLine" AS CmdLine,
  COALESCE("ImageLoaded", "TargetFilename", '') AS Artifact,
  "ParentImage" AS ParentProcess,
  CASE
    WHEN "EventCode" = '7' THEN 'CompressionDllLoad'
    WHEN "EventCode" = '1' AND (LOWER("Image") LIKE '%powershell.exe' OR LOWER("Image") LIKE '%pwsh.exe') THEN 'PowerShellLibraryCompression'
    WHEN "EventCode" = '1' AND LOWER("Image") LIKE '%python%' THEN 'PythonLibraryCompression'
    WHEN "EventCode" = '11' THEN 'StagedCompressedFileCreation'
    ELSE 'Unknown'
  END AS DetectionSource
FROM events
WHERE
  devicetime > (CURRENT_TIMESTAMP - 86400000)
  AND LOGSOURCETYPEID(logsourceid) IN (SELECT id FROM logsourcetypes WHERE name LIKE '%Sysmon%')
  AND (
    (
      "EventCode" = '7'
      AND (
        LOWER("ImageLoaded") LIKE '%\\zlib.dll' OR LOWER("ImageLoaded") LIKE '%\\zlib1.dll'
        OR LOWER("ImageLoaded") LIKE '%\\zlibwapi.dll' OR LOWER("ImageLoaded") LIKE '%\\bzip2.dll'
        OR LOWER("ImageLoaded") LIKE '%\\libbzip2.dll' OR LOWER("ImageLoaded") LIKE '%\\libzip.dll'
        OR LOWER("ImageLoaded") LIKE '%\\minizip.dll'
      )
      AND LOWER("ImageLoaded") NOT LIKE '%\\system32\\%'
      AND LOWER("ImageLoaded") NOT LIKE '%\\syswow64\\%'
      AND LOWER("Image") NOT LIKE '%\\7z.exe'
      AND LOWER("Image") NOT LIKE '%\\winrar.exe'
      AND LOWER("Image") NOT LIKE '%\\msiexec.exe'
    )
    OR (
      "EventCode" = '1'
      AND (LOWER("Image") LIKE '%\\powershell.exe' OR LOWER("Image") LIKE '%\\pwsh.exe')
      AND (
        "CommandLine" LIKE '%IO.Compression%' OR "CommandLine" LIKE '%GZipStream%'
        OR "CommandLine" LIKE '%DeflateStream%' OR "CommandLine" LIKE '%ZipArchive%'
        OR "CommandLine" LIKE '%ZipFile%' OR "CommandLine" LIKE '%ICSharpCode%'
        OR "CommandLine" LIKE '%DotNetZip%' OR "CommandLine" LIKE '%System.IO.Compression%'
      )
    )
    OR (
      "EventCode" = '1'
      AND (LOWER("Image") LIKE '%\\python.exe' OR LOWER("Image") LIKE '%\\python3.%')
      AND (
        "CommandLine" LIKE '%import zlib%' OR "CommandLine" LIKE '%import bz2%'
        OR "CommandLine" LIKE '%import gzip%' OR "CommandLine" LIKE '%import zipfile%'
        OR "CommandLine" LIKE '%import rarfile%' OR "CommandLine" LIKE '%zlib.compress%'
        OR "CommandLine" LIKE '%bz2.compress%' OR "CommandLine" LIKE '%import lzma%'
        OR "CommandLine" LIKE '%import tarfile%'
      )
    )
    OR (
      "EventCode" = '11'
      AND (
        LOWER("TargetFilename") LIKE '%.gz' OR LOWER("TargetFilename") LIKE '%.bz2'
        OR LOWER("TargetFilename") LIKE '%.zlib' OR LOWER("TargetFilename") LIKE '%.lzma'
        OR LOWER("TargetFilename") LIKE '%.xz' OR LOWER("TargetFilename") LIKE '%.lz'
      )
      AND (
        LOWER("TargetFilename") LIKE '%\\temp\\%' OR LOWER("TargetFilename") LIKE '%\\appdata\\%'
        OR LOWER("TargetFilename") LIKE '%\\programdata\\%'
        OR LOWER("TargetFilename") LIKE '%\\users\\public\\%'
      )
      AND (
        LOWER("Image") LIKE '%\\python.exe' OR LOWER("Image") LIKE '%\\python3.exe'
        OR LOWER("Image") LIKE '%\\ruby.exe' OR LOWER("Image") LIKE '%\\perl.exe'
        OR LOWER("Image") LIKE '%\\node.exe' OR LOWER("Image") LIKE '%\\java.exe'
        OR LOWER("Image") LIKE '%\\wscript.exe' OR LOWER("Image") LIKE '%\\cscript.exe'
        OR LOWER("Image") LIKE '%\\mshta.exe'
      )
    )
  )
ORDER BY devicetime DESC