regex101: PCRE2 (PHP) Match Workspace

(?ms)applies the following effective flags to the remainder of the pattern: ms

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

s modifier: single line. Allows a dot to match line terminators

<Eventthe literal text <Event (case sensitive)

Negated Character Class[^>]*

*matches any number of characters outside the set below:

>the literal > (62₁₀ / 76₈ / 3E₁₆)

.*?any character, repeated any number of times

<System>the literal text <System> (case sensitive)

.*?any character, repeated any number of times

<Providerthe literal text <Provider (case sensitive)

\s+any whitespace character, repeated at least once

Name='the literal text Name=' (case sensitive)

Group ProviderName(?<ProviderName>[^']*)

Negated Character Class[^']*

*matches any number of characters outside the set below:

'the literal ' (39₁₀ / 47₈ / 27₁₆)

\s+any whitespace character, repeated at least once

Guid='the literal text Guid=' (case sensitive)

Group ProviderGuid(?<ProviderGuid>[^']*)

Negated Character Class[^']*

*matches any number of characters outside the set below:

'the literal ' (39₁₀ / 47₈ / 27₁₆)

.*?any character, repeated any number of times

<EventID>the literal text <EventID> (case sensitive)

Group EventID(?<EventID>\d+)

\d+a digit, repeated at least once

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

EventID>the literal text EventID> (case sensitive)

.*?any character, repeated any number of times

<Version>the literal text <Version> (case sensitive)

Group Version(?<Version>\d+)

\d+a digit, repeated at least once

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Version>the literal text Version> (case sensitive)

.*?any character, repeated any number of times

<Level>the literal text <Level> (case sensitive)

Group Level(?<Level>\d+)

\d+a digit, repeated at least once

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Level>the literal text Level> (case sensitive)

.*?any character, repeated any number of times

<Task>the literal text <Task> (case sensitive)

Group Task(?<Task>\d+)

\d+a digit, repeated at least once

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Task>the literal text Task> (case sensitive)

.*?any character, repeated any number of times

<Opcode>the literal text <Opcode> (case sensitive)

Group Opcode(?<Opcode>\d+)

\d+a digit, repeated at least once

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Opcode>the literal text Opcode> (case sensitive)

.*?any character, repeated any number of times

<Keywords>the literal text <Keywords> (case sensitive)

Group Keywords(?<Keywords>[^<]*)

Negated Character Class[^<]*

*matches any number of characters outside the set below:

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Keywords>the literal text Keywords> (case sensitive)

.*?any character, repeated any number of times

<TimeCreatedthe literal text <TimeCreated (case sensitive)

\s+any whitespace character, repeated at least once

SystemTime='the literal text SystemTime=' (case sensitive)

Group SystemTime(?<SystemTime>[^']*)

Negated Character Class[^']*

*matches any number of characters outside the set below:

'the literal ' (39₁₀ / 47₈ / 27₁₆)

.*?any character, repeated any number of times

<EventRecordID>the literal text <EventRecordID> (case sensitive)

Group EventRecordID(?<EventRecordID>\d+)

\d+a digit, repeated at least once

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

EventRecordID>the literal text EventRecordID> (case sensitive)

.*?any character, repeated any number of times

<Correlationthe literal text <Correlation (case sensitive)

\s+any whitespace character, repeated at least once

ActivityID='the literal text ActivityID=' (case sensitive)

Group ActivityID(?<ActivityID>[^']*)

Negated Character Class[^']*

*matches any number of characters outside the set below:

'the literal ' (39₁₀ / 47₈ / 27₁₆)

.*?any character, repeated any number of times

<Executionthe literal text <Execution (case sensitive)

\s+any whitespace character, repeated at least once

ProcessID='the literal text ProcessID=' (case sensitive)

Group ProcessID(?<ProcessID>\d+)

\d+a digit, repeated at least once

'the literal ' (39₁₀ / 47₈ / 27₁₆)

\s+any whitespace character, repeated at least once

ThreadID='the literal text ThreadID=' (case sensitive)

Group ThreadID(?<ThreadID>\d+)

\d+a digit, repeated at least once

'the literal ' (39₁₀ / 47₈ / 27₁₆)

.*?any character, repeated any number of times

<Channel>the literal text <Channel> (case sensitive)

Group Channel(?<Channel>[^<]*)

Negated Character Class[^<]*

*matches any number of characters outside the set below:

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Channel>the literal text Channel> (case sensitive)

.*?any character, repeated any number of times

<Computer>the literal text <Computer> (case sensitive)

Group Computer(?<Computer>[^<]*)

Negated Character Class[^<]*

*matches any number of characters outside the set below:

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Computer>the literal text Computer> (case sensitive)

.*?any character, repeated any number of times

<EventData>the literal text <EventData> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='SubjectUserSid'>the literal text Name='SubjectUserSid'> (case sensitive)

Group SubjectUserSid(?<SubjectUserSid>[^<]*)

Negated Character Class[^<]*

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='SubjectUserName'>the literal text Name='SubjectUserName'> (case sensitive)

Group SubjectUserName(?<SubjectUserName>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='SubjectDomainName'>the literal text Name='SubjectDomainName'> (case sensitive)

Group SubjectDomainName(?<SubjectDomainName>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='SubjectLogonId'>the literal text Name='SubjectLogonId'> (case sensitive)

Group SubjectLogonId(?<SubjectLogonId>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='TargetUserSid'>the literal text Name='TargetUserSid'> (case sensitive)

Group TargetUserSid(?<TargetUserSid>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='TargetUserName'>the literal text Name='TargetUserName'> (case sensitive)

Group TargetUserName(?<TargetUserName>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='TargetDomainName'>the literal text Name='TargetDomainName'> (case sensitive)

Group TargetDomainName(?<TargetDomainName>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='TargetLogonId'>the literal text Name='TargetLogonId'> (case sensitive)

Group TargetLogonId(?<TargetLogonId>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='LogonType'>the literal text Name='LogonType'> (case sensitive)

Group LogonType(?<LogonType>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='EventIdx'>the literal text Name='EventIdx'> (case sensitive)

Group EventIdx(?<EventIdx>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='EventCountTotal'>the literal text Name='EventCountTotal'> (case sensitive)

Group EventCountTotal(?<EventCountTotal>[^<]*)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<Datathe literal text <Data (case sensitive)

\s+any whitespace character, repeated at least once

Name='GroupMembership'>the literal text Name='GroupMembership'> (case sensitive)

Group GroupMembership(?<GroupMembership>.*?)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>the literal text Data> (case sensitive)

.*?any character, repeated any number of times

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

EventData>the literal text EventData> (case sensitive)

.*?any character, repeated any number of times

<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Event>the literal text Event> (case sensitive)

25 tokens

Regular Expression

(?ms)<Event[^>]*>.*?<System>.*?<Provider\s+Name='(?<ProviderName>[^']*)'\s+Guid='(?<ProviderGuid>[^']*)'.*?<EventID>(?<EventID>\d+)<\/EventID>.*?<Version>(?<Version>\d+)<\/Version>.*?<Level>(?<Level>\d+)<\/Level>.*?<Task>(?<Task>\d+)<\/Task>.*?<Opcode>(?<Opcode>\d+)<\/Opcode>.*?<Keywords>(?<Keywords>[^<]*)<\/Keywords>.*?<TimeCreated\s+SystemTime='(?<SystemTime>[^']*)'.*?<EventRecordID>(?<EventRecordID>\d+)<\/EventRecordID>.*?<Correlation\s+ActivityID='(?<ActivityID>[^']*)'.*?<Execution\s+ProcessID='(?<ProcessID>\d+)'\s+ThreadID='(?<ThreadID>\d+)'.*?<Channel>(?<Channel>[^<]*)<\/Channel>.*?<Computer>(?<Computer>[^<]*)<\/Computer>.*?<EventData>.*?<Data\s+Name='SubjectUserSid'>(?<SubjectUserSid>[^<]*)<\/Data>.*?<Data\s+Name='SubjectUserName'>(?<SubjectUserName>[^<]*)<\/Data>.*?<Data\s+Name='SubjectDomainName'>(?<SubjectDomainName>[^<]*)<\/Data>.*?<Data\s+Name='SubjectLogonId'>(?<SubjectLogonId>[^<]*)<\/Data>.*?<Data\s+Name='TargetUserSid'>(?<TargetUserSid>[^<]*)<\/Data>.*?<Data\s+Name='TargetUserName'>(?<TargetUserName>[^<]*)<\/Data>.*?<Data\s+Name='TargetDomainName'>(?<TargetDomainName>[^<]*)<\/Data>.*?<Data\s+Name='TargetLogonId'>(?<TargetLogonId>[^<]*)<\/Data>.*?<Data\s+Name='LogonType'>(?<LogonType>[^<]*)<\/Data>.*?<Data\s+Name='EventIdx'>(?<EventIdx>[^<]*)<\/Data>.*?<Data\s+Name='EventCountTotal'>(?<EventCountTotal>[^<]*)<\/Data>.*?<Data\s+Name='GroupMembership'>(?<GroupMembership>.*?)<\/Data>.*?<\/EventData>.*?<\/Event>

New

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3bxxxxxx}'/><EventID>4627</EventID><Version>0</Version><Level>0</Level><Task>12554</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-11-27T11:27:45.6695363Z'/><EventRecordID>2177113</EventRecordID><Correlation ActivityID='{01491b93-40a4-0002-6926-4901a440db01}'/><Execution ProcessID='1196' ThreadID='1312'/><Channel>Security</Channel><Computer>Computer1</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>CXXXXXX</Data><Data Name='SubjectDomainName'>CXXXXXXXX</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='TargetUserSid'>S-1-5-18</Data><Data Name='TargetUserName'>SYSTEM</Data><Data Name='TargetDomainName'>NT AUTHORITY</Data><Data Name='TargetLogonId'>0x3e7</Data><Data Name='LogonType'>5</Data><Data Name='EventIdx'>1</Data><Data Name='EventCountTotal'>1</Data><Data Name='GroupMembership'>
%{S-1-5-32-544}
%{S-1-1-0}
%{S-1-5-11}
%{S-1-16-16384}</Data></EventData></Event>