# Regex is killing me

**URL:** <https://community.graylog.org/t/regex-is-killing-me/11046>\
**Category:** Graylog Central (peer support)\
**Created:** [July 4, 2019, 2:24pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046 "2019-07-04T14:24:56Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\
**Post date:** [July 4, 2019, 2:24pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/1 "2019-07-04T14:24:56Z")

</div>

I’m trying to enrich a bunch of windows sysmon logs. The ultimate goal is to set a field on processes launched from an office application. I.e. if Word launches Powershell or an unknown process, I want to know about it.

I know Java regex seems a bit pickier than others, but here is where I’m at. Here are some samples from of sysmon logs.

```
explorer.exe
C:\WINDOWS\system32\WerFault.exe -u -p 137120 -s 4024
C:\WINDOWS\system32\WerFault.exe -pss -s 792 -p 137120 -ip 137120
"C:\Program Files (x86)\Adobe\Acrobat 2017\Acrobat\AcroCEF\AcroCEF.exe" --backgroundcolor=5066061
C:\Program Files (x86)\Adobe\Reader DC\AcroRd32.exe

```

I want to filter out noise from Adobe products (and note the occasional double-quote at the start).

`(?i)(c:\\program files \(x86\)\\adobe).*$`

This works in both [https://regex101.com/r/BYUqJO/1/](https://regex101.com/r/BYUqJO/1/) and [https://www.freeformatter.com/java-regex-tester.html#ad-output](https://www.freeformatter.com/java-regex-tester.html#ad-output)

However, the moment I try to use it in my pipeline, the editor cries about it. Not to mention, I can’t get an optional capture group around the (x86) working either. To me, it should be `( \(x86\))?`

```
rule "Threat Intel - Sysmon Parent Process" 
when 
    (has_field("parent_command") OR has_field("parent_process")) AND
    (regex("(?i)(acrobat|winword|excel|lync|powerpnt|acrord32|notepad|calc)", to_string($message.parent_command)).matches == true OR 
    regex("(?i)(acrobat|winword|excel|lync|powerpnt|acrord32|notepad|calc)", to_string($message.parent_process)).matches == true) AND 
    (to_string($message.command) != "C:\\WINDOWS\\splwow64.exe 8192" AND
    regex("(?i)(c:\\program files \(x86\)\\adobe).*$",to_string($message.command)).matches != true) 
then
set_field("suspicious_parent",to_bool("true"));
end

```

Any pointers? Where have I bunged this up, aside from being a total rookie with regex.

---

<div class="post-metadata">

**Author:** ![NeoGeo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/neogeo/32/4576_2.png) [@NeoGeo](https://community.graylog.org/u/NeoGeo)\
**Post date:** [July 4, 2019, 3:59pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/2 "2019-07-04T15:59:26Z")

</div>

I believe your optional x86 requires the space inside the paren section as follows:

```auto
( \(x86\))?

```

See: [https://regexr.com/3f4vo](https://regexr.com/3f4vo)

---

<div class="post-metadata">

**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\
**Post date:** [July 4, 2019, 5:29pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/3 "2019-07-04T17:29:46Z")

</div>

I have the space in tests

---

<div class="post-metadata">

**Author:** ![lindonm](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@lindonm](https://community.graylog.org/u/lindonm)\
**Post date:** [July 5, 2019, 4:20am UTC](https://community.graylog.org/t/regex-is-killing-me/11046/4 "2019-07-05T04:20:06Z")

</div>

> [@BlueTeamNinja](#):
>
> explorer.exe C:\WINDOWS\system32\WerFault.exe -u -p 137120 -s 4024 C:\WINDOWS\system32\WerFault.exe -pss -s 792 -p 137120 -ip 137120 “C:\Program Files (x86)\Adobe\Acrobat 2017\Acrobat\AcroCEF\AcroCEF.exe” --backgroundcolor=5066061 C:\Program Files (x86)\Adobe\Reader DC\AcroRd32.exe

Your regex should work, but looks like it might be a bug in Graylog - It didn’t like the ( and x combo.

Try the below, seems to match your samples & requirements. Note I added an optional line which might be simpler for you, “starts\_with”

```auto
rule "Threat Intel - Sysmon Parent Process" 
when 
    ( has_field("parent_command") OR 
      has_field("parent_process")
    ) AND (
        regex("(?i)(acrobat|winword|excel|lync|powerpnt|acrord32|notepad|calc)", to_string($message.parent_command)).matches == true OR 
        regex("(?i)(acrobat|winword|excel|lync|powerpnt|acrord32|notepad|calc)", to_string($message.parent_process)).matches == true
    ) AND (
        to_string($message.command) != "C:\\WINDOWS\\splwow64.exe 8192" AND
        starts_with(to_string($message.command), "c:\\program files (x86)\\adobe", true) AND
        regex("(?i)(c:\\program Files(\s(.*?))?)\\adobe",to_string($message.command)).matches != true 
    )
then
    set_field("suspicious_parent",to_bool("true"));
end

```

---

<div class="post-metadata">

**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\
**Post date:** [July 5, 2019, 3:37pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/5 "2019-07-05T15:37:33Z")

</div>

Thanks @lindonm  
I’m trying to use your code and I’m getting ‘Invalid Expression’ error Line 3, Column 4 and I can’t find the typo myself. 😕

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [July 5, 2019, 4:43pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/6 "2019-07-05T16:43:26Z")

</div>

did you double escape the escapes?

java Regex make it really hard sometimes, I personal try to check in [https://www.freeformatter.com/java-regex-tester.html](https://www.freeformatter.com/java-regex-tester.html)

But the double escape the escapes usually makes the trick

---

<div class="post-metadata">

**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\
**Post date:** [July 6, 2019, 9:48pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/7 "2019-07-06T21:48:42Z")

</div>

Can you give an example?

I can’t make the same sample work with either two or three escapes.

---

<div class="post-metadata">

**Author:** ![lindonm](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@lindonm](https://community.graylog.org/u/lindonm)\
**Post date:** [July 7, 2019, 11:37pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/8 "2019-07-07T23:37:22Z")

</div>

Actually the error was on the program files regex line sorry - Try this, i’m not sure if it will actually match for you though it does allow me to save it now (added double escapes as per Jan’s comment)

```auto
regex("(?i)(c:\\\\program Files(\\s(.*?))?)\\\\adobe",to_string($message.command)).matches != true 

```

---

<div class="post-metadata">

**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\
**Post date:** [July 8, 2019, 2:04pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/9 "2019-07-08T14:04:09Z")

</div>

That did it! Thanks @lindonm  
Now that I know I need 4 slashes to replace one…  
So, by that logic, do I need 8 slashes for a Windows UNC? `\\Serverlocation\Folder\File.exe` ? That seems pretty intense.

---

<div class="post-metadata">

**Author:** ![lindonm](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@lindonm](https://community.graylog.org/u/lindonm)\
**Post date:** [July 8, 2019, 10:58pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/10 "2019-07-08T22:58:40Z")

</div>

I can only assume so, try it out and let us know 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 22, 2019, 10:58pm UTC](https://community.graylog.org/t/regex-is-killing-me/11046/11 "2019-07-22T22:58:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.