$re = '/(?ms)Target Account:.*Security ID:\s+(?<Security_ID>[^ ]*)/';
$str = ' LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=server.domain.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=00000000
Keywords=Audit Success
Message=A user account was changed.
Subject:
Security ID: DOMAIN\\account_1
Account Name: account_1
Account Domain: DOMAIN
Logon ID: 0000000
Target Account:
Security ID: DOMAIN\\account_2
Account Name: account_2
Account Domain: DOMAIN';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php