regex101: PCRE (Legacy) Match Workspace

(?ms)applies the following effective flags to the remainder of the pattern: gms

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

s modifier: single line. Allows a dot to match line terminators

.*any character, repeated any number of times

EventCodethe literal text EventCode (case sensitive)

\=the literal = (61₁₀ / 75₈ / 3D₁₆)

Group 1(4624|4672|4634)

1st Alternative4624

4624the literal text 4624

2nd Alternative4672

4672the literal text 4672

3rd Alternative4634

4634the literal text 4634

.*any character, repeated any number of times

Securitythe literal text Security (case sensitive)

\sany whitespace character

ID:the literal text ID: (case sensitive)

\sany whitespace character

S-1-5-21-34345566-23432455-2001the literal text S-1-5-21-34345566-23432455-2001 (case sensitive)

\s+any whitespace character, repeated at least once

Account Name:the literal text Account Name: (case sensitive)

\sany whitespace character

_svc_abdthe literal text _svc_abd (case sensitive)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

25 tokens

Regular Expression

(?ms).*EventCode\=(4624|4672|4634).*Security\sID:\sS-1-5-21-34345566-23432455-2001\s+Account Name:\s_svc_abd

New

LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=abc.ttt.com
TaskCategory=Logon
OpCode=Info
RecordNumber=3434545
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
Security ID: S-1-0-0
Account Name:
Account Domain:
Logon ID:

Logon Type: 3

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-21-34345566-23432455-2001
Account Name: _svc_abd 
Account Domain: ttt
Logon ID: 0x4E41454
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID:
Process Name:
Network Information:
Workstation Name:
Source Network Address:
Source Port:
Detailed Authentication Information:
Logon Process: NtLmSsp 
Authentication Package: NTLM
Transited Services:
Package Name (NTLM only): NTLM V2
Key Length: 0