regex101: PCRE (Legacy) Match Workspace

Group 1([^,;\n\v{}<>\t=:\[\]\"\']+?)

Negated Character Class[^,;\n\v{}<>\t=:\[\]\"\']+?

+?matches at least one character outside the set below:

,the literal , (44₁₀ / 54₈ / 2C₁₆)

;the literal ; (59₁₀ / 73₈ / 3B₁₆)

\na line-feed (newline) character (ASCII 10)

\vany vertical whitespace character

{the literal { (123₁₀ / 173₈ / 7B₁₆)

}the literal } (125₁₀ / 175₈ / 7D₁₆)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

>the literal > (62₁₀ / 76₈ / 3E₁₆)

\ta tab character (ASCII 9)

=the literal = (61₁₀ / 75₈ / 3D₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

\'the literal ' (39₁₀ / 47₈ / 27₁₆)

Character Class[=:]

=the literal = (61₁₀ / 75₈ / 3D₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Character Class[ \t]*

*matches any number of characters from the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\ta tab character (ASCII 9)

Non-Capturing Group(?:\"((?:[^\"\\]|\\.)*)\"|([^\t =:\"\n\v\t\{\}\[\]<>](?!(?!,)\S+[:=])(?:[^\n\v\t\{\}\[\]=:<>](?!(?!,)\S+[:=]))*))

1st Alternative\"((?:[^\"\\]|\\.)*)\"

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group 2((?:[^\"\\]|\\.)*)

Non-Capturing Group(?:[^\"\\]|\\.)*

*repeats the group contents below any number of times:

1st Alternative[^\"\\]

Negated Character Class[^\"\\]

\"the literal " (34₁₀ / 42₈ / 22₁₆)

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

2nd Alternative\\.

\\the literal \ (92₁₀ / 134₈ / 5C₁₆)

.any character (except for line terminators)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

2nd Alternative([^\t =:\"\n\v\t\{\}\[\]<>](?!(?!,)\S+[:=])(?:[^\n\v\t\{\}\[\]=:<>](?!(?!,)\S+[:=]))*)

Group 3([^\t =:\"\n\v\t\{\}\[\]<>](?!(?!,)\S+[:=])(?:[^\n\v\t\{\}\[\]=:<>](?!(?!,)\S+[:=]))*)

Negated Character Class[^\t =:\"\n\v\t\{\}\[\]<>]

\ta tab character (ASCII 9)

the literal (32₁₀ / 40₈ / 20₁₆)

=the literal = (61₁₀ / 75₈ / 3D₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

\na line-feed (newline) character (ASCII 10)

\vany vertical whitespace character

\ta tab character (ASCII 9)

\{the literal { (123₁₀ / 173₈ / 7B₁₆)

\}the literal } (125₁₀ / 175₈ / 7D₁₆)

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

>the literal > (62₁₀ / 76₈ / 3E₁₆)

Negative Lookahead(?!(?!,)\S+[:=])

Negative Lookahead(?!,)

,the literal , (44₁₀ / 54₈ / 2C₁₆)

\S+any non-whitespace character, repeated at least once

Character Class[:=]

:the literal : (58₁₀ / 72₈ / 3A₁₆)

=the literal = (61₁₀ / 75₈ / 3D₁₆)

Non-Capturing Group(?:[^\n\v\t\{\}\[\]=:<>](?!(?!,)\S+[:=]))*

*repeats the group contents below any number of times:

Negated Character Class[^\n\v\t\{\}\[\]=:<>]

\na line-feed (newline) character (ASCII 10)

\vany vertical whitespace character

\ta tab character (ASCII 9)

\{the literal { (123₁₀ / 173₈ / 7B₁₆)

\}the literal } (125₁₀ / 175₈ / 7D₁₆)

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

=the literal = (61₁₀ / 75₈ / 3D₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

>the literal > (62₁₀ / 76₈ / 3E₁₆)

Negative Lookahead(?!(?!,)\S+[:=])

Negative Lookahead(?!,)

,the literal , (44₁₀ / 54₈ / 2C₁₆)

\S+any non-whitespace character, repeated at least once

Character Class[:=]

:the literal : (58₁₀ / 72₈ / 3A₁₆)

=the literal = (61₁₀ / 75₈ / 3D₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

Search reference

Regular Expression

([^,;\n\v{}<>\t=:\[\]\"\']+?)[=:][ \t]*(?:\"((?:[^\"\\]|\\.)*)\"|([^\t =:\"\n\v\t\{\}\[\]<>](?!(?!,)\S+[:=])(?:[^\n\v\t\{\}\[\]=:<>](?!(?!,)\S+[:=]))*))

New

05/02/2011 03:47:12 PM
LogName=Security
SourceName= ##Source_Name##
EventCode=4624
EventType=##Event_Type##
Type=##Type##
ComputerName=##Computer_Name##
TaskCategory=##Task_Category##
OpCode=##OpCode##
RecordNumber=##Record_Number##
Keywords=##Keyword_Success##
Message=An account was successfully logged on.

January 05-11 03:47:12 PM
Subject:
 Security ID:  ##Domain##\SYSTEM
 Account Name:  ##Computer_Name##
 Account Domain:  ##Domain##
 Logon ID:  0x##System_Logon_Id##

Jan 27 03:47:12 PM
Logon Information:
 Logon Type:  ##Logon_Type##
 Restricted Admin Mode: ##Restricted_Admin_Mode##
 Virtual Account:  ##Virtual_Account##
 Elevated Token:  ##Elevated_Token##

Impersonation Level:  ##Impersonation_Level##

New Logon:
 Security ID:  ##Domain##\##User_Name##
 Account Name:  ##User_Name##
 Account Domain:  ##Domain##
 Logon ID:  0x##Logon_Id##
 Linked Logon ID:  ##Linked_Logon_Id##
 Network Account Name: ##User_Name2##
 Network Account Domain: ##Domain2##
 Logon ##GUID##:  ##Logon_Guid##

Process Information:
 Process ID:  0x##Process_Id##
 Process Name:  ##Process_Name##

Network Information:
 Workstation Name: ##Computer_Name##
 Source Network Address: ##Network_Ip##
 Source Port:  ##Network_Port##

Detailed Authentication Information:
 Logon Process:  ##Logon_Process## 
 Authentication Package: ##Authentication_Package##
 Transited Services: ##Transited_Services##
 Package Name (NTLM only): ##Package_Name##
 Key Length:  ##Key_Length##