Regular Expressions 101

\<the literal < (60₁₀ / 74₈ / 3C₁₆)

EventIDthe literal text EventID (case sensitive)

\>the literal > (62₁₀ / 76₈ / 3E₁₆)

4656the literal text 4656

\<the literal < (60₁₀ / 74₈ / 3C₁₆)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

EventIDthe literal text EventID (case sensitive)

\>the literal > (62₁₀ / 76₈ / 3E₁₆)

.*any character (except for line terminators), repeated any number of times

\<the literal < (60₁₀ / 74₈ / 3C₁₆)

Data Namethe literal text Data Name (case sensitive)

\=the literal = (61₁₀ / 75₈ / 3D₁₆)

\'the literal ' (39₁₀ / 47₈ / 27₁₆)

ProcessNamethe literal text ProcessName (case sensitive)

\'the literal ' (39₁₀ / 47₈ / 27₁₆)

\>the literal > (62₁₀ / 76₈ / 3E₁₆)

Group 1(C|D|E|F)

1st AlternativeC

Cthe literal C (67₁₀ / 103₈ / 43₁₆) (case sensitive)

2nd AlternativeD

Dthe literal D (68₁₀ / 104₈ / 44₁₆) (case sensitive)

3rd AlternativeE

Ethe literal E (69₁₀ / 105₈ / 45₁₆) (case sensitive)

4th AlternativeF

Fthe literal F (70₁₀ / 106₈ / 46₁₆) (case sensitive)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Windowsthe literal text Windows (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

System32the literal text System32 (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

CpqMgmtthe literal text CpqMgmt (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

cqmghostthe literal text cqmghost (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

cqmghostthe literal text cqmghost (case sensitive)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

exethe literal text exe (case sensitive)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

\<EventID\>4656\<\/EventID\>.*\<Data Name\=\'ProcessName\'\>(C|D|E|F):\\Windows\\System32\\CpqMgmt\\cqmghost\\cqmghost\.exe

New

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4656</EventID><Version>1</Version><Level>0</Level><Task>12801</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-08-12T19:47:25.544399300Z'/><EventRecordID>1397935969</EventRecordID><Correlation/><Execution ProcessID='716' ThreadID='728'/><Channel>Security</Channel><Computer>svr-apl-cit-01.BANCOREGIONAL.LOCAL</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>SVR-APL-CIT-01$</Data><Data Name='SubjectDomainName'>BANCOREGIONAL</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>Key</Data><Data Name='ObjectName'>\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SamSs</Data><Data Name='HandleId'>0x584</Data><Data Name='TransactionId'>{00000000-0000-0000-0000-000000000000}</Data><Data Name='AccessList'>%%1537 %%1538 %%1539 %%1540 %%4432 %%4433 %%4434 %%4435 %%4436 %%4437 </Data><Data Name='AccessReason'>-</Data><Data Name='AccessMask'>0xf003f</Data><Data Name='PrivilegeList'>-</Data><Data Name='RestrictedSidCount'>0</Data><Data Name='ProcessId'>0x1ec0</Data><Data Name='ProcessName'>C:\Windows\System32\CpqMgmt\cqmghost\cqmghost.exe</Data><Data Name='ResourceAttributes'>-</Data></EventData></Event>