regex101: PCRE2 (PHP) Match Workspace

Group 1((?s).*EventCode=4688*.)

(?s)applies the following effective flags to the remainder of the pattern: gms

s modifier: single line. Allows a dot to match line terminators

.*any character, repeated any number of times

EventCode=468the literal text EventCode=468 (case sensitive)

8*the literal 8 (56₁₀ / 70₈ / 38₁₆) , repeated any number of times

.any character

Group 2((?si).*(%%1936|%%1938TokenElevationTypeDefault|TokenElevationTypeLimited))

(?si)applies the following effective flags to the remainder of the pattern: gmsi

s modifier: single line. Allows a dot to match line terminators

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

.*any character, repeated any number of times

Group 3(%%1936|%%1938TokenElevationTypeDefault|TokenElevationTypeLimited)

1st Alternative%%1936

%%1936the literal text %%1936

2nd Alternative%%1938TokenElevationTypeDefault

%%1938TokenElevationTypeDefaultthe literal text %%1938TokenElevationTypeDefault (case insensitive)

3rd AlternativeTokenElevationTypeLimited

TokenElevationTypeLimitedthe literal text TokenElevationTypeLimited (case insensitive)

the literal ↵ (10₁₀ / 12₈ / A₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

((?s).*EventCode=4688*.)((?si).*(%%1936|%%1938TokenElevationTypeDefault|TokenElevationTypeLimited))

New

A new process has been created.

Creator Subject:
 Security ID:  SYSTEM
 Account Name:  RFSH$
 Account Domain:  LAB
 Logon ID:  0x3E7
 EventCode=4688
Target Subject:
 Security ID:  LAB\rsmith
 Account Name:  rsmith
 Account Domain:  LAB
 Logon ID:  0x2C9D82

Process Information:
 New Process ID:  0x2e0e4
 New Process Name: C:\Windows\System32\RuntimeBroker.exe
 Token Elevation Type: %%1936
 Mandatory Label:  Mandatory Label\Medium Mandatory Level
 Creator Process ID: 0x268
 Creator Process Name: C:\Windows\System32\svchost.exe
 Process Command Line: