use strict;
my $str = '05/03/2024 02:46:06 PM
LogName=Security
EventCode=4624
EventType=0
ComputerName=myhost
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=0
Keywords=Audit Success
TaskCategory=Logon
OpCode=Info
Message=An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Delegation
New Logon:
Security ID: DOMAIN\\user.adm
Account Name: user.adm
Account Domain: DOMAIN.LOCAL
Logon ID: 0
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address:
Source Port: 63095
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
04/30/2024 04:49:05 PM
LogName=Security
EventCode=4659
EventType=0
ComputerName=MyHost
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=0
Keywords=Audit Success
TaskCategory=File System
OpCode=Info
Message=A handle to an object was requested with intent to delete.
Subject:
Security ID: myuser
Account Name: myuser
Account Domain: Domain
Logon ID: 0x580B3D59
Object:
Object Server: Security
Object Type: File
Object Name: D:\\Test_share\\prova.txt
Handle ID: 0x0
Process Information:
Process ID: 0x4
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
ReadAttributes
Access Mask: 0x10080
Privileges Used for Access Check: -';
my $regex = qr/(EventCode=(4624|4634|4625)\X*Account Name:(\s+.*\.adm.*))|(EventCode=(4659|4663|5145)\X*Object Name:(\s+.*Test_share.*))/mp;
if ( $str =~ /$regex/g ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html