In typical XCM transfers the sequence of events are:
- assets transferred from user account to destination sovereign account (or burned)
- XCM sent to destination
- XCM arrives on destination
- withdraw assets from origin sovereign account
- execute rest of XCM
- deposit to beneficiary
In some cases (Bifrost oracle updates etc.) assets are directly withdrawn on destination without a transfer on origin.
From quick initial analysis it seems there's no guaranteed way to tell them apart without relying on heuristics based on events related to the origin XCM execution, since we have no visibility on the XCM instructions executed on the origin.