Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Reg
ular
Ex
pressions
101
Upgrade to Pro
Enterprise
Regular Expression
/
\"md5\":\"(?<md5>[^\"]+)
/
gm
Input 1
New
payload={"config_id":5,"config_rev_id":12,"finding":{"system_info":{"bits":64,"build_number":"18363","os":"Microsoft Windows 10 Enterprise","patch_level":"10.0.28263.0.0","platform":"Windows"}},"intel_id":211,"match":{"contexts":[{"event":{},"process":{"uniqueEventId":"72057594038813812","uniqueProcessId":"-7276340288713644715"}},{"event":{},"process":{"uniqueEventId":"72057594038813812","uniqueProcessId":"-7276340288713644715"}}],"hash":1618797647,"properties":{"args":"\"C:\\WINDOWS\\System32\\Wbem\\WMIC.exe\" logicaldisk where \"DeviceID ='C:'\" get FreeSpace,Size \/format:value","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe","md5":"f86f3ca37e51f8a6bd352c3s0471ed1e","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe","parent":{"args":"powershell \"wmic logicaldisk where \\\"DeviceID ='C:'\\\" get FreeSpace,Size \/format:value\"","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","md5"
Substitution
payload={"config_id":5,"config_rev_id":12,"finding":{"system_info":{"bits":64,"build_number":"18363","os":"Microsoft Windows 10 Enterprise","patch_level":"10.0.28263.0.0","platform":"Windows"}},"intel_id":211,"match":{"contexts":[{"event":{},"process":{"uniqueEventId":"72057594038813812","uniqueProcessId":"-7276340288713644715"}},{"event":{},"process":{"uniqueEventId":"72057594038813812","uniqueProcessId":"-7276340288713644715"}}],"hash":1618797647,"properties":{"args":"\"C:\\WINDOWS\\System32\\Wbem\\WMIC.exe\" logicaldisk where \"DeviceID ='C:'\" get FreeSpace,Size \/format:value","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe","md5":"f86f3ca37e51f8a6bd352c3s0471ed1e","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe","parent":{"args":"powershell \"wmic logicaldisk where \\\"DeviceID ='C:'\\\" get FreeSpace,Size \/format:value\"","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","md5"