$re = '/not \(?\s*1 of \s*([\w\*]*)\s*\)?|not \(?\s*all of \s*([\w\*]*)\s*\)?|not \s*([^\d\(][^\(\s]*)|not \(\s*([^\d]+.*)\s?\)/m';
$str = '( passwordchanged and not passwordchanged_filter ) | near samrpipe
( selection_cammute and not filter_cammute ) or ( selection_chrome_frame and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc ) or ( selection_msmpeng and not filter_msmpeng ) or ( selection_msseces and not filter_msseces ) or ( selection_oinfo and not filter_oinfo ) or ( selection_oleview and not filter_oleview ) or ( selection_rc and not filter_rc )
(exec_selection and not exec_exclusion) or (create_selection and create_keywords)
(selection1 and not filter1) or selection2 or selection3 or selection4
all of selection and not (1 of exclusion_*)
keywords and not 1 of filters
methregistry or ( methprocess and not filterprocess )
selection and not ( filter1 or filter2 )
selection and not ( filter1 or filter2 or filter3 )
selection and not (ini or intel)
selection and not 1 of falsepositive*
selection and not (1 of falsepositive*)
selection and not exclusion
selection and not falsepositive
selection and not falsepositives
selection and not filter
selection and not reduction
selection1 and not selection2
selection1 or ( selection2 and not filter2 )
selection_registry and not exclusion_images
selector | near dllload1 and dllload2 and not exclusion
selection and not (filter1)
selection and not all of falsepositive*
selection and not (all of falsepositive*)
selection and selection2
selection or (selection2 and selection3)
selection or 1 of selection*';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php