Regular Expressions 101

Community Patterns

Powershell - Get-Process Parser

0

Regular Expression
PCRE (PHP <7.3)

/
^\"\w+\"\,(?:\")?(?<process>([\w|\s|\,|\.|\-|\+]+)?)(?:\")?\,\"(?<handles>\d+)\"\,\"(?<VM>[\-\d|\d]+)\"\,\"(?<WS>\d+)\"\,\"(?<PM>\d+)\"\,\"(?<NPM>\d+)\"\,(?:\")?(?<Path>([a-zA-Z]\:\\[\\\w\s\.\-\(\)\+|*\w]+)?)(?:\")?\,(?:\")?(?<Company>([\w|\s|\,|\.|\@]+)?)(?:\")?\,(?:\")?(?<CPU>[\d|\.]+)?(?:\")?\,(?:\")?(?<FileVersion>[\d|\.|\s|\(|\w|\_|\-|\)]+)?(?:\")?\,(?:\")?(?<ProductVersion>[\d|\.|\s|\(|\w|\_|\-|\)]+)?(?:\")?\,(?:\")?(?<Description>[\d|\.|\s|\(|\w|\_|\-|\|\+|\:)]+)?(?:\")?\,(?:\")?(?<Product>[\w|\s||\+|\(|\)]+)?(?:\")?\,(?:\")?(?<Id>[\w|\s||\+|\(|\)]+)?(?:\")?\,(?:\")?(?<PriorityClass>[\w|\s||\+|\(|\)]+)?(?:\")?\,(?:\")?(?<HandleCount>[\w|\s||\+|\(|\)]+)?(?:\")?\,
/
gm

Description

This parser has been created to parse a CSV file has been exported by this powershell command (Get-Process | Select-Object -Property * | ConvertTo-Csv | Out-File Get-Process .csv) in order to understand every single activity within Microsoft® Windows® Operating System.

The generated file has been imported in Splunk for the analysis proposes and it was needed to build this parser to parse 65 properties. All of the properties listed as below: 1. __NounName 2. Name 3. Handles 4. VM 5. WS 6. PM 7. NPM 8. Path 9. Company 10. CPU 11. FileVersion 12. ProductVersion 13. Description 14. Product 15. Id 16. PriorityClass 17. HandleCount 18. WorkingSet 19. PagedMemorySize 20. PrivateMemorySize 21. VirtualMemorySize 22. TotalProcessorTime 23. BasePriority 24. ExitCode 25. HasExited 26. ExitTime 27. Handle 28. SafeHandle 29. MachineName 30. MainWindowHandle 31. MainWindowTitle 32. MainModule 33. MaxWorkingSet 34. MinWorkingSet 35. Modules 36. NonpagedSystemMemorySize 37. NonpagedSystemMemorySize64 38. PagedMemorySize64 39. PagedSystemMemorySize 40. PagedSystemMemorySize64 41. PeakPagedMemorySize 42. PeakPagedMemorySize64 43. PeakWorkingSet 44. PeakWorkingSet64 45. PeakVirtualMemorySize 46. PeakVirtualMemorySize64 47. PriorityBoostEnabled 48. PrivateMemorySize64 49. PrivilegedProcessorTime 50. ProcessName 51. ProcessorAffinity 52. Responding 53. SessionId 54. StartInfo 55. StartTime 56. SynchronizingObject 57. Threads 58. UserProcessorTime 59. VirtualMemorySize64 60. EnableRaisingEvents 61. StandardInput 62. StandardOutput 63. StandardError 64. WorkingSet64 65. Site

Submitted by anonymous - 4 years ago