Detect Ignore Process Interrupts in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  hostname AS device_name,
  username,
  "process" AS process_name,
  "cmdline" AS command_line,
  CASE
    WHEN LOWER("cmdline") MATCHES '.*nohup\s+.*(\x2ftmp\x2f|\x2fvar\x2ftmp\x2f|\x2fdev\x2fshm\x2f).*' THEN 1 ELSE 0
  END +
  CASE
    WHEN LOWER("cmdline") MATCHES '.*(netcat|ncat|socat|\x2fbin\x2fnc\s).*' THEN 1 ELSE 0
  END +
  CASE
    WHEN LOWER("cmdline") MATCHES '.*(-i\s|bash\s-i|sh\s-i).*' THEN 1 ELSE 0
  END +
  CASE
    WHEN LOWER("cmdline") MATCHES '.*\x2fetc\x2finit\.d\x2f.*|.*\x2fetc\x2frc\..*|.*\x2fetc\x2fcron.*' THEN 1 ELSE 0
  END +
  CASE
    WHEN "cmdline" MATCHES '.*&\s*$' THEN 1 ELSE 0
  END AS nohup_suspicion_score,
  CASE
    WHEN LOWER("cmdline") MATCHES '.*(invoke-webrequest|net\.webclient|downloadstring|downloadfile|invoke-expression|iex\(|-encodedcommand|-enc\s).*' THEN 1 ELSE 0
  END +
  CASE
    WHEN LOWER("cmdline") MATCHES '.*(schtasks|sc\screate|reg\sadd|new-service|set-mppreference|add-mppreference).*' THEN 1 ELSE 0
  END +
  CASE
    WHEN LOWER("cmdline") MATCHES '.*(certutil|start-bitstransfer|bitsadmin).*' THEN 1 ELSE 0
  END AS ps_suspicion_score,
  CASE
    WHEN "process" LIKE 'nohup' OR "cmdline" LIKE '%nohup %' THEN 'nohup_interrupt_ignore'
    WHEN LOWER("process") IN ('powershell.exe', 'pwsh.exe') AND
         LOWER("cmdline") MATCHES '.*(silentlycontinue|erroractionpreference|-erroraction ignore|-ea ignore).*' THEN 'ps_error_suppression'
    ELSE 'unknown'
  END AS detection_type,
  CATEGORYNAME(category) AS event_category,
  sourceip AS source_ip
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Apple Mac OS X', 'Microsoft Windows', 'Sysmon')
  AND starttime > DATEADD('hour', -24, NOW())
  AND (
    -- nohup detection (Linux/macOS)
    "process" = 'nohup'
    OR (
      "cmdline" LIKE '%nohup %' AND
      "process" IN ('bash', 'sh', 'dash', 'zsh', 'ksh', 'python3', 'python', 'perl', 'ruby')
    )
    -- PowerShell error suppression with malicious indicators (Windows)
    OR (
      LOWER("process") IN ('powershell.exe', 'pwsh.exe') AND
      LOWER("cmdline") MATCHES '.*(silentlycontinue|erroractionpreference|-erroraction ignore|-ea ignore|-ea silentlycontinue).*' AND
      LOWER("cmdline") MATCHES '.*(invoke-webrequest|net\.webclient|downloadstring|invoke-expression|iex\(|-encodedcommand|schtasks|sc\screate|reg\sadd|new-service|set-mppreference|certutil).*'
    )
  )
ORDER BY event_time DESC