regex101: Test Regex

1st Alternative.*wmic.*process.*call.*create.*

.*any character (except for line terminators), repeated any number of times

wmicthe literal text wmic (case insensitive)

.*any character (except for line terminators), repeated any number of times

processthe literal text process (case insensitive)

.*any character (except for line terminators), repeated any number of times

callthe literal text call (case insensitive)

.*any character (except for line terminators), repeated any number of times

createthe literal text create (case insensitive)

.*any character (except for line terminators), repeated any number of times

2nd Alternative.*invoke-wmimethod.*(-class win32_process|-name create).*(-name create|-class win32_process).*

.*any character (except for line terminators), repeated any number of times

invoke-wmimethodthe literal text invoke-wmimethod (case insensitive)

.*any character (except for line terminators), repeated any number of times

Group 1(-class win32_process|-name create)

1st Alternative-class win32_process

-class win32_processthe literal text -class win32_process (case insensitive)

2nd Alternative-name create

-name createthe literal text -name create (case insensitive)

.*any character (except for line terminators), repeated any number of times

Group 2(-name create|-class win32_process)

1st Alternative-name create

-name createthe literal text -name create (case insensitive)

2nd Alternative-class win32_process

-class win32_processthe literal text -class win32_process (case insensitive)

.*any character (except for line terminators), repeated any number of times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

Search reference

Regular Expression

.*wmic.*process.*call.*create.*|.*invoke-wmimethod.*(-class win32_process|-name create).*(-name create|-class win32_process).*

New

wmic process call create
wmic process call create “notepad.exe”
wmic /node:IP process call create “calc.exe”
wmic /node:10.146.215.157 process call create "notepad.exe"
invoke-wmimethod -Class win32_process -Name create -ArguementList "calc.exe" -ComputerName "tdiscwin-as-t1p"
Invoke-WmiMethod -Class win32_process -Name create -ArguementList "calc.exe" -ComputerName "tdiscwin-as-t1p"
Invoke-WmiMethod -Class Win32_Process -name Create -ArguementList 'notepad.exe' -ComputerName 192.168.72.134 - Credential 'WIN-B85AAA7ST4U\Administrator'
Invoke-WmiMethod -ComputerName Test -Class Win32_Process -Name Create -ArgumentList "Notepad.exe"
Invoke-WmiMethod -Name Create -Class Win32_Process -ArgumentList "Notepad.exe"