Mariadb always writes tmp disk to a file
Read the manual where it mentions using MEMORY for temp tables and when it will switch to MyISAM, either because of limitations such as TEXT or because of exceeding LEAST(tmp_table_size, max_hash_table_size).  Further note that VARCHARs become CHAR for calculating when to spill to disk.  (This is fixed in 8.0; I doubt if it is yet in 10.4.)  Example: VARCHAR(250) utf8mb4 counts as 1000 bytes.

See EXPLAIN SELECT.  If it says Using temporary, that is a clue.  However, that phrase is usually on the first line of the EXPLAIN not necessarily on the line that triggered the need.

Each of DISTINCT, GROUP BY, and ORDER BY may need a temp table.  If the query involves a JOIN, then it is more likely that one of those will trigger the need for a temp table.

Do not fear temp tables; some queries simply require such.  A simple example is any query with GROUP BY something ORDER BY something_else.

Granted, the above does not say whether the temp table is on disk or in memory.

If that does not suffice, please provide a specific case.  Show us the query and SHOW CREATE TABLE and EXPLAIN SELECT .... We should be able to help you change so that it does not need a disk-based temp table or explain why it must use such.

To check to see if a particular query uses disk temp table(s), do something like:

SHOW SESSION STATUS LIKE 'Created_tmp_disk_tables';
SELECT ...
SHOW SESSION STATUS LIKE 'Created_tmp_disk_tables';


That is a counter, hence the need to check before and after.

The slowlog might also give you a clue.