regex101: PCRE (Legacy) Match Workspace

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

sid:the literal text sid: (case sensitive)

Group sid(?<sid>[^\]]*)

Negated Character Class[^\]]*

*matches any number of characters outside the set below:

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

\[sid:(?<sid>[^\]]*)\]

New

A suspicious packet was sent [sid:2008518] -- Detected an attempt to make a configuration change in SQL DB using the legit 'sp_configure' command The xp_cmdshell option is a SQL Server server configuration option that enables system administrators to control whether the xp_cmdshell extended stored procedure can be executed on a system. By default, the xp_cmdshell option is disabled on new installations. Before enabling this option, it is important to consider the potential security implications associated with the use of this option. It is proposed to disable the xp_cmdhsell option.

Regular Expressions 101

Regular Expression

Extraction