regex101: PCRE (Legacy) Match Workspace

.*any character (except for line terminators), repeated any number of times

powershellthe literal text powershell (case sensitive)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

exethe literal text exe (case sensitive)

.*any character (except for line terminators), repeated any number of times

\-the literal - (45₁₀ / 55₈ / 2D₁₆)

Character Class[Ee^]{1,2}

{1,2}matches between 1 and 2 characters from the set below:

Ethe literal E (69₁₀ / 105₈ / 45₁₆) (case sensitive)

ethe literal e (101₁₀ / 145₈ / 65₁₆) (case sensitive)

^the literal ^ (94₁₀ / 136₈ / 5E₁₆)

Character Class[NnCcOoDdEeMmAa^]*

*matches any number of characters from the set below:

Nthe literal N (78₁₀ / 116₈ / 4E₁₆) (case sensitive)

nthe literal n (110₁₀ / 156₈ / 6E₁₆) (case sensitive)

Cthe literal C (67₁₀ / 103₈ / 43₁₆) (case sensitive)

cthe literal c (99₁₀ / 143₈ / 63₁₆) (case sensitive)

Othe literal O (79₁₀ / 117₈ / 4F₁₆) (case sensitive)

othe literal o (111₁₀ / 157₈ / 6F₁₆) (case sensitive)

Dthe literal D (68₁₀ / 104₈ / 44₁₆) (case sensitive)

dthe literal d (100₁₀ / 144₈ / 64₁₆) (case sensitive)

Ethe literal E (69₁₀ / 105₈ / 45₁₆) (case sensitive)

ethe literal e (101₁₀ / 145₈ / 65₁₆) (case sensitive)

Mthe literal M (77₁₀ / 115₈ / 4D₁₆) (case sensitive)

mthe literal m (109₁₀ / 155₈ / 6D₁₆) (case sensitive)

Athe literal A (65₁₀ / 101₈ / 41₁₆) (case sensitive)

athe literal a (97₁₀ / 141₈ / 61₁₆) (case sensitive)

^the literal ^ (94₁₀ / 136₈ / 5E₁₆)

\s*any whitespace character, repeated any number of times

Character Class[A-Za-z0-9+\/=]{5,}

{5,}matches at least 5 characters from the set below:

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

+the literal + (43₁₀ / 53₈ / 2B₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

=the literal = (61₁₀ / 75₈ / 3D₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

.*powershell\.exe.*\-[Ee^]{1,2}[NnCcOoDdEeMmAa^]*\s*[A-Za-z0-9+\/=]{5,}

New

powershell.exe -encodedCommand JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA
powershell.exe -Enc JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA
powershell.exe -e JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA
powershell.exe -w Hidden -ENC JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA

Substitution

powershell.exe -encodedCommand JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA
powershell.exe -Enc JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA
powershell.exe -e JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA
powershell.exe -w Hidden -ENC JwBtAGkAawBlAGYAcgBvAGIAYgBpAG4AcwAuAGMAbwBtACcA