regex101: PCRE2 (PHP) Match Workspace

$end of line

XmlRegex=%<Providerthe literal text XmlRegex=%<Provider (case sensitive)

Negated Character Class[^>]+

+matches at least one character outside the set below:

>the literal > (62₁₀ / 76₈ / 3E₁₆)

Name=the literal text Name= (case sensitive)

Character Class["']

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

Microsoft-Windows-Security-Auditingthe literal text Microsoft-Windows-Security-Auditing (case sensitive)

Character Class["']

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

% the literal text %

$end of line

XmlRegex=%<EventID>4688<the literal text XmlRegex=%<EventID>4688< (case sensitive)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

EventID>% the literal text EventID>% (case sensitive)

$end of line

XmlRegex=%<Data Name=the literal text XmlRegex=%<Data Name= (case sensitive)

Character Class["']

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

NewProcessNamethe literal text NewProcessName (case sensitive)

Character Class["']

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

>C:the literal text >C: (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Program Files the literal text Program Files (case sensitive)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

x86the literal text x86 (case sensitive)

\)the literal ) (41₁₀ / 51₈ / 29₁₆)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Taniumthe literal text Tanium (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Tanium Clientthe literal text Tanium Client (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

TaniumClientthe literal text TaniumClient (case sensitive)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

exe<the literal text exe< (case sensitive)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>% the literal text Data>% (case sensitive)

$end of line

XmlRegex=%<Data Name=the literal text XmlRegex=%<Data Name= (case sensitive)

Character Class["']

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

ParentProcessNamethe literal text ParentProcessName (case sensitive)

Character Class["']

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

>C:the literal text >C: (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Program Files the literal text Program Files (case sensitive)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

x86the literal text x86 (case sensitive)

\)the literal ) (41₁₀ / 51₈ / 29₁₆)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Taniumthe literal text Tanium (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

Tanium Clientthe literal text Tanium Client (case sensitive)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

TaniumClientthe literal text TaniumClient (case sensitive)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

exe<the literal text exe< (case sensitive)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Data>%the literal text Data>% (case sensitive)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

$XmlRegex=%<Provider[^>]+Name=["']Microsoft-Windows-Security-Auditing["']% $XmlRegex=%<EventID>4688<\/EventID>% $XmlRegex=%<Data Name=["']NewProcessName["']>C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\TaniumClient\.exe<\/Data>% $XmlRegex=%<Data Name=["']ParentProcessName["']>C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\TaniumClient\.exe<\/Data>%

Unit Tests

There are no unit tests, click to add some.