regex101: PCRE (Legacy) Match Workspace

Non-Capturing Group(?:^Group Membership:|\G(?!^))

1st Alternative^Group Membership:

^start of line

Group Membership:the literal text Group Membership: (case sensitive)

2nd Alternative\G(?!^)

\Gstart of current search

Negative Lookahead(?!^)

^start of line

\r?optionally matches a carriage return (ASCII 13)

\na line-feed (newline) character (ASCII 10)

Character Class[\t ]*

*matches any number of characters from the set below:

\ta tab character (ASCII 9)

the literal (32₁₀ / 40₈ / 20₁₆)

Non-Capturing Group(?:[^\\\r\n]*\\)*

*repeats the group contents below any number of times:

Negated Character Class[^\\\r\n]*

*matches any number of characters outside the set below:

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

\ra carriage return (ASCII 13)

\na line-feed (newline) character (ASCII 10)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Group 1(.+)

.+any character (except for line terminators), repeated at least once

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

(?:^Group Membership:|\G(?!^))\r?\n[\t ]*(?:[^\\\r\n]*\\)*(.+)

New

Subject:
	Security ID:
	Account Name:
	Account Domain:
	Logon ID:

Logon Type:			3

New Logon:
	Security ID:		ABC\SH07
	Account Name:		SH07
	Account Domain:		ABC
	Logon ID:		0xEB7A5403

Event in sequence:		1 of 1

Group Membership:
	  ABC\Domain Users 
	  Everyone 
	  BUILTIN\Users 
	  NT AUTHORITY\NETWORK 
	  NT AUTHORITY\Authenticated Users 
	  NT AUTHORITY\This Organization 
	  ABC\FS-ABCDEFG-Workspaces_CS-Production-WIP_MODIFY 
	  ABC\FS-ABCDEFG-Workspaces_CS-EntertainmentDesign-WIP_READ
	  ABC\FS-ABCDEFG-Wspaces_CS-Print-WIP_READ 
	  ABC\Workstations-Desktop-Add Remove 
	  ABC\FS-ABCDEFG-Wpaces_CS-Imagery-WIP_READ 
	  Authentication authority asserted identity 
	  ABC\APP-JDE-123